FPDI is a collection of PHP classes that help developers read pages from existing PDF documents and use them as templates in FPDF. For versions earlier than 2.6.7, an attacker can upload a small, malicious PDF that will cause the server-side script to crash because of memory exhaustion or a script time-out. The crash leads to a cessation of service until the script is restarted, effectively denying service to legitimate users. Repeated attacks can lead to sustained service unavailability. This vulnerability is a classic example of resource exhaustion, identified by CWE-400 and CWE-770.

The vulnerability affects Setasign’s FPDI library, specifically any installation using a version earlier than 2.6.7. Users who integrate FPDI into PHP web applications through file‑upload mechanisms and have not updated to the latest release are at risk.

The CVSS score of 6 indicates a moderate severity. No EPSS data is currently available, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via an HTTP request that uploads a malicious PDF to a PHP script utilizing FPDI. Repeat attacks can keep the service unavailable, so the risk to availability is significant even without confirmed exploits.