CyberRota Analysis
AI-GeneratedThe Pillow Python imaging library versions 5.1.0 to 12.2.0 are vulnerable due to a flaw in the PdfParser.PdfStream.decode() method, which allows crafted FlateDecode PDF streams to cause memory exhaustion by exploiting unbounded decompression output. This vulnerability poses a high risk of denial of service, particularly for applications that process PDF files. Developers and organizations utilizing affected versions should prioritize upgrading to version 12.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)