An attacker can craft a PDF that causes pypdf, when used in non‑strict mode, to enter an endless loop during recovery attempts in the DictionaryObject.read_from_stream function. The loop consumes CPU time and memory without making progress, effectively locking the host application. This results in a denial of service rather than code execution or data exfiltration. The weakness stems from improper condition checks (CWE‑606) and uncontrolled loop increments (CWE‑835).

The flaw affects all pypdf versions older than 6.9.2 on any operating system, because the library is pure Python and widely used in scripts and applications that process PDF files. Any Python program that imports pypdf and opens PDFs with non‑strict parsing is vulnerable.

The CVSS v3.1 score of 4.6 indicates moderate severity, while the EPSS score of less than 1 % and absence from the CISA KEV catalog suggest a low probability of exploitation in the wild. The attack vector would require the delivery of a malicious PDF to the target application, typically via local user input or an uploaded file. Using strict parsing, if available, mitigates the risk.