The vulnerability allows an attacker to craft a PDF that repeatedly references a nonexistent indirect object. When processed by pypdf, these repeated references trigger full-file recovery loads for each reference, resulting in extremely long runtimes and high CPU usage. The weakness is a classic uncontrolled resource consumption scenario, classified under CWE-400. The impact is a denial of service, potentially causing application hangs or memory exhaustion for any process that parses the malicious PDF.

The affected product is the pypdf library provided by py-pdf. Any version prior to 6.21.2 is vulnerable; the fix is delivered in release 6.21.2 and later. All applications that load PDFs using vulnerable pypdf versions are at risk.

The CVSS score of 7.1 indicates a medium‑high severity. EPSS data is not available, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but it can be triggered simply by supplying a malicious PDF to any program that uses pypdf. Based on the description, it is inferred that the attack vector is supplying the crafted PDF to an endpoint that processes PDFs, which could be local or remote depending on the software architecture. No privileged escalation is required; the attack exploits only the resource consumption behavior of the library.