A PDF parsing flaw in the open‑source pypdf library allows an attacker to craft a malicious PDF that, when processed in non‑strict mode, can cause unusually long runtimes by omitting the /Root entry while specifying a very large /Size value. The resulting delay does not compromise confidentiality or integrity, but it can consume significant CPU resources, effectively leading to a denial‑of‑service condition for the process or application using the library. The weakness maps to CWE‑400, which describes unbounded resource usage.

The vulnerability affects the pypdf project, specifically versions prior to 6.6.0. All installations that rely on the non‑strict reading mode of pypdf before this release are susceptible. The issue was addressed in release 6.6.0 and later.

The CVSS score of 2.7 indicates a low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The attack vector requires an attacker to supply a crafted PDF file to the vulnerable process; no privileged access or additional conditions are specified in the description. Because the issue is limited to non‑strict mode, systems that have not configured strict parsing may remain at risk. The vulnerability is not listed in the CISA KEV catalog, further indicating its limited impact profile.