The vulnerability resides in the pypdf library, a pure-Python PDF manipulation package. Versions earlier than 6.9.2 allow a malicious PDF to trigger an infinite loop while the library attempts to recover a dictionary object during stream parsing. The loop consumes CPU and memory until the process terminates, resulting in denial of service. The flaw corresponds to CWE-835: Infinite Loop.

All installations of py-pdf:pypdf that run a version older than 6.9.2 and use non-strict mode are affected. Any application that imports pypdf to read or manipulate PDF files can be impacted. Upgrading to 6.9.2 or later mitigates the issue.

The CVSS score of 4.6 denotes moderate severity, but the practical risk of exhausting system resources and causing application downtime is significant. No publicly disclosed exploits exist and the flaw is not listed in CISA’s KEV catalog. The only prerequisite is delivering a crafted PDF to the library, making the attack vector simple and likely to be used against services that process untrusted PDFs. Although EPSS data is unavailable, the overall risk warrants immediate attention.