pdfcpu is a Go library for PDF manipulation. This vulnerability is an uncontrolled recursion flaw (CWE-674) in the parser, where the functions ParseObjectContext() and parseArray() walk through nested PDF objects without imposing a maximum depth. A PDF file that contains deeply nested objects can exhaust stack or heap memory, causing the process to crash or hang and thereby denying service. The flaw is triggered simply by parsing the document and does not depend on elevated privileges.

All deployments that use pdfcpu through version 0.11.1 for handling PDFs are affected. The issue resides in the library’s parse.go file and is distributed via GitHub and Go modules. Because no vendor namespace is explicitly tied to the library, any project that embeds pdfcpu v0.11.1 or earlier is vulnerable.

The CVSS score of 7.5 marks the fault as high severity. The EPSS score of less than 1% indicates a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. An attacker merely needs a PDF document that triggers deep recursion; the likely attack vector is the remote ingestion of such a crafted PDF. Exploitation conditions are minimal beyond the presence of the vulnerable library.