This vulnerability allows an attacker to craft a PDF that, when processed by pypdf, causes the library to enter an infinite loop while handling outlines and bookmarks. The loop can consume significant CPU and memory, potentially exhausting system resources and rendering the application unresponsive. The flaw is a classic infinite‑loop weakness and is classified as CWE‑835. There is no known path to arbitrary code execution or data disclosure.

The issue affects the py-pdf pypdf library in any version prior to 6.6.2. All installations using older releases are vulnerable unless they have applied the manual changes from the referenced pull request.

The calculated CVSS score is 5.1, indicating a moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a specially crafted PDF that is parsed by the vulnerable library, which typically occurs in applications that load PDFs from untrusted sources. If such parsing is performed in a high‑privilege context, the resulting denial of service could be critical to business operations.