Prior to v7.7.0, Lychee’s image‑handling component uses ImageMagick and Ghostscript to render PDFs without bounding the media box size. An attacker who can authenticate and upload a small PDF with an oversized /MediaBox can trigger Imagick::readImage to consume large amounts of CPU time before failing, resulting in a high‑impact denial of service that stalls image processing. The flaw is caused by the absence of a pre‑render limit on page dimensions, leading to uncontrolled resource consumption (CWE‑400) and potential buffer exhaustion (CWE‑770).

The vulnerability affects Lychee versions earlier than 7.7.0. It is relevant for installations that allow authenticated users to upload PDFs via ImagickHandler::loadPdf(). The issue exists in the core Lychee application shipped by LycheeOrg and is not limited to a particular deployment mode.

The CVSS score of 7.1 classifies this as a high‑severity vulnerability, but the EPSS score is below 1 %, indicating a low probability of active exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires victim credentials and the ability to upload a malicious PDF, so the attack vector is an authenticated web upload. In configurations where the web worker processes synchronously, the request can occupy a worker for up to several minutes, while asynchronous Docker farms risk clogging a shared processing queue and delaying other tasks.