An attacker can craft a PDF that contains cross‑reference streams or object streams with incorrect large "/Size or "/N" values. When pypdf processes such a file it performs lengthy computations that can keep the interpreter busy for an extended period. This causes excessive CPU usage and potentially high memory consumption, effectively denying service to the application that parsed the PDF. The weakness is classified as CWE‑834 and CWE‑1284, indicating data structures are mishandled during parsing and that large or unsupported values can lead to exhaustion.

Py‑pdf pypdf versions earlier than 6.10.1 are affected. Any system that imports these libraries and loads PDFs without additional validation is vulnerable. Versions 6.10.1 and later contain a fix that correctly handles the size fields.

The CVSS score of 6.9 reflects a moderate impact with limited exploitation complexity. The EPSS score is below 1%, and the vulnerability is not listed in CISA KEV, so there is no evidence of widespread exploitation yet. The likely attack vector is a malicious PDF delivered to an application that uses pypdf to read it, either locally or over a network, without user authentication. Once parsed, the malformed streams can keep the process busy or consume excessive resources, leading to availability degradation.