The vulnerability involves an infinite loop in the PDF trailer parsing routine of Pillow that can be triggered by a specially crafted PDF file. When parsed, the loop consumes 100 % of a CPU core, causing the application to hang indefinitely. This denial of service is limited to the process using Pillow and does not provide code execution or data disclosure. CWE‑835, Uncontrolled Resource Consumption, applies.

Pillow is the Python imaging library used by numerous Python applications. Versions from 4.2.0 through 12.1.x are affected. The issue was fixed in Pillow 12.2.0. Upgrading to this or any later release eliminates the problem.

The CVSS score of 5.1 classifies the flaw as moderate. The EPSS score is not available, but the lack of a KEV listing indicates no known widespread exploitation. The attack vector is likely local or remote via a PDF input; the vulnerability requires the application to load a malicious PDF with Pillow. An attacker can disrupt service by inducing the infinite loop, but cannot gain further privilege or access. The overall risk is moderate, with highest impact on availability of software that consumes PDFs.