pypdf, a pure‑Python PDF manipulation library, contains a vulnerability that allows an attacker to craft a PDF document with a cross‑reference stream whose /W entry consists solely of zeros and whose /Size value is very large. When the library processes this stream it spends an inordinate amount of time iterating over the /Size entries, potentially exhausting CPU or memory resources. This results in a denial of service because the library becomes unresponsive for the remainder of the code path that handles the PDF. The weakness involves processing errors, including CWE‑606 and CWE‑834.

The affected product is py‑pdf:pypdf, specifically any version earlier than 6.12.0. Version 6.12.0 and later include the fix and are not affected.

The CVSS score of 5.1 places this vulnerability in the moderate severity range. EPSS score of less than 1% indicates a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack scenario involves an adversary delivering a crafted PDF to a system that loads or renders PDFs via pypdf, either as a local user or through a remote service that accepts user‑supplied PDFs. The exploit path does not require elevated privileges, but it does require the vulnerable library to process the malicious PDF. While the risk is mitigated by the moderate CVSS score, environments that expect high availability or that use pypdf to process untrusted documents should consider the potential impact of prolonged run times. This vulnerability is best mitigated through an update rather than a temporary workaround.