An attacker can craft a PDF document with an unusually large \/Size trailer entry and load it using pypdf in incremental mode. The library then performs an exhaustive routine that runs for an extended period, consuming CPU and memory resources. This can lead to a denial‑of‑service condition on the system that processes the PDF, but the vulnerability cannot be used for arbitrary code execution or data exfiltration.

The flaw affects the open‑source pypdf library (py-pdf:pypdf). Versions prior to 6.10.2 are vulnerable; the fix was released with 6.10.2. Systems that import or use pypdf to process PDFs, particularly in or automated pipelines, are at risk.

The CVSS score of 4.8 indicates a moderate impact, and the EPSS score shows an exploitation probability of less than 1%. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker supply a malicious PDF to a process that uses pypdf in incremental mode. Based on the description, it is inferred that the attack vector involves local input rather than remote exploitation. Systems parsing untrusted PDFs should treat this as a moderate risk, with exploitation possible if the library is invoked by an attacker-controlled workflow.