Technical impact
The vulnerability resides in the EPS parser of Pillow 12.0.0 through 12.2.0, where a negative byte count in a %%BeginBinary directive causes Image.open() to repeatedly seek backward to the same directive and reparse it. This unbounded loop exhausts CPU and memory resources, resulting in a denial of service. The weakness is a control‑flow bug that allows an attacker to trigger an infinite loop (CWE‑835).
Affected Systems
Pillow, a widely used Python imaging library, is impacted by this flaw. All releases from 12.0.0 up to 12.2.0 are vulnerable, while the issue is fixed in version 12.3.0. Applications that load or transform EPS files – especially those that accept user‑supplied documents – are at risk.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, and the EPSS figure of less than 1% points to a low likelihood of exploitation in practice; the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector likely requires an attacker to supply a crafted EPS file that the application processes with Image.open(), which in turn triggers the infinite loop. No code execution or privilege escalation is achieved; the impact is limited to service disruption on the affected host.
Github GHSA
Ubuntu USN