The vulnerability is a buffer overflow in PDFunite 0.41.0 that causes a segmentation fault when processing a specially crafted PDF. The overflow occurs in the XRef::getEntry function of libpoppler, resulting in the application crashing and potentially denying service to users relying on PDF merging. This flaw is classified as CWE-120.

The affected product is PDFunite, part of the poppler-utils package. The vulnerable release is 0.41.0. Users running this version or older should be aware that the flaw exists in the PDF merging utility.

The CVSS score of 6.9 indicates a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a limited but still significant exploitation potential. The attack vector is local: an attacker who can supply a malicious PDF file to the pdfunite utility can induce a crash. No remote execution or data exfiltration is described, so the primary impact is denial of service for local users or processes. Given the lack of a public exploit and the local nature of the attack, the risk is moderate but warrants timely remediation.