The flaw exists in Pillow's PdfParser.rewrite_pages method, causing an infinite loop when it encounters a page tree with a circular Parent reference. An attacker crafting a cyclic PDF and feeding it to an application that uses Pillow to append an image can trigger the loop, consuming the worker's CPU indefinitely and effectively denying service.

Affected vendors: Python Pillow. The issue spans versions 5.1.0 through 13.0.0 inclusive. Versions 13.0.0 and later include the fix, as indicated by the release notes and security advisory.

The CVSS score of 8.7 indicates high severity. Without a published EPSS score, the probability of exploitation remains unknown, but since the flaw leads to a full‑CPU loop, it is likely to be a local or application‑level DoS. The vulnerability is not currently listed in the CISA KEV catalog. An application processing user‑supplied PDFs—such as document management or image editing tools that use Pillow—could be targeted; the attacker must provide a malicious PDF that triggers the cycle.