An infinite loop occurs when the pypdf library processes the children of a TreeObject, typically used for outlines in a PDF. The loop consumes CPU resources and can cause the parsing application to hang or crash, resulting in a denial of service. This weakness is classified as a logical flaw that can lead to application unavailability, potentially affecting services that rely on PDF processing.

The vulnerability applies to the pypdf Python library for all versions prior to 6.7.1, released by the py-pdf project. Any system or application that imports pypdf and parses untrusted PDF files is potentially affected.

The CVSS score of 6.9 indicates a moderate impact. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and the issue is not listed as a known exploited vulnerability. An attacker would need to supply a crafted PDF that contains a malicious TreeObject to a vulnerable application; the attack vector is inferred to be via file upload or remote processing of untrusted PDFs. Exploitation relies on the ability to load the PDF within an environment where resource limits are not tightly controlled, and the loop can be triggered without additional credentials.