The vulnerability stems from multiple functions in BlpImagePlugin.py using direct file descriptor reads (fd.read()) without verifying the returned data length. The commit diff shows replacements of fd.read() with _safe_read() (which validates read lengths) in these functions. Specifically: 1) _read_palette handled color data without length checks, 2) _read_blp_header parsed critical offsets without validation, and 3) Blp1Decoder._load processed image streams without verifying read success. These unverified reads allowed attackers to trigger repeated decoder executions on empty/invalid data, enabling the DoS vulnerability.