Pizzy Library EUVD-2026-36718

Attacker must hold valid low-privilege credentials (PR:L) to a service exposing Pizzy Library over the network (AV:N), and that service must reach a Pizzy Library endpoint lacking frequency/throttling controls; no user interaction is required (UI:N) and exploitation complexity is low (AC:L). Limiting factors: deployments that already front the library with rate-limiting middleware, API gateways, or WAF quota policies materially reduce exploitability, as does restricting authentication to a small trusted population - the flaw is not exploitable pre-authentication.

The CVSS vector AV:N/AC:L/PR:L/UI:N indicates network-reachable, low-complexity exploitation requiring only low-privilege authentication, with the primary impact on availability (A:H) and partial integrity (I:L) but no confidentiality loss (C:N) - consistent with a flooding/DoS-class flaw rather than data exposure. The 7.1 score is therefore credible as a real availability risk for any deployment that authenticates a broad user population, since a single low-privilege account suffices. No EPSS score, KEV listing, or public POC was provided, suggesting exploitation is plausible but not confirmed widespread; the 'Information Disclosure' tag in the input conflicts with the CVSS vector showing C:N - this contradiction should be verified with the vendor before treating the issue as a confidentiality concern.

An attacker who has obtained or registered a low-privilege account on a service that embeds Pizzy Library issues a high-volume stream of operations against an endpoint that lacks frequency controls, exhausting CPU or memory and rendering the service unresponsive to other users. Because no public exploit is identified at time of analysis, the most likely real-world abuse is opportunistic disruption by insiders or compromised low-tier accounts rather than mass automated exploitation.