The vulnerability lies in the parsing of PDF cross‑reference (xref) tables and is classified as CWE‑834 and CWE‑606. An attacker can craft a PDF whose declared xref entry count exceeds the number of entries actually present. When pypdf processes such a file, it performs excessive checks and loops, leading to very long runtimes. The result is a denial‑of‑service condition for any application that parses the file, as the process may hang or consume excessive CPU resources.

The vulnerability affects the pypdf library maintained by py‑pdf. Versions older than 6.21.2 are impacted; the fix is included in release 6.21.2 onward.

The CVSS score of 7.1 indicates a high severity, while the EPSS score is not available, so the probability of exploitation is unknown. The issue is not listed in CISA's KEV catalog. Attackers could exploit this by delivering a malicious PDF file to any application that imports and parses PDFs using the affected version of pypdf. If the application processes the file in a user‑directed context, the attacker can cause the application to become unresponsive or consume excessive CPU, potentially leading to service degradation or denial of service. Based on the description, the likely attack vector is local file processing or a network channel where the PDF is received and parsed by a service.