The vulnerability lies in Pillow’s PDF stream decoder, where the zlib decompression function is called with a buffer size directly derived from the PDF Length field. Because this size is not bounded, a crafted PDF using the FlateDecode filter can cause the library to allocate a large amount of memory from a deceptively small input file. The result is a memory exhaustion attack that leads to a denial of service in processes that load the compromised PDF. The weakness is reflected by CWE‑770.

The issue affects Pillow images library versions 5.1.0 through 12.3.0, exclusive, that depend on Pillow and process untrusted PDF files. Vulnerable environments include web servers, document converters, or automated image processing pipelines that rely on the PdfParser module. The fix is included in Pillow 12.3.0.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker would likely need to supply a PDF file to a target that unconditionally parses PDF content, so the attack vector is inferred as local or file ingestion; all that is required is that the target application accepts and decodes a malicious PDF.