A crafted PDF that triggers an infinite loop during font retrieval in layout-mode text extraction causes the pypdf library to consume CPU and memory indefinitely, effectively denying service to the process that is handling the PDF. This flaw is a classic infinite loop vulnerability, classified as CWE‑835, and leads to resource exhaustion without compromising confidentiality or integrity.

Applications that incorporate py-pdf’s pypdf library and perform text extraction in layout mode are affected. Versions of pypdf earlier than 6.13.0 are vulnerable; the fix is released in pypdf 6.13.0 and later.

The vulnerability has a CVSS score of 6.9, indicating a moderate severity. EPSS is not available, so the likelihood of exploitation cannot be quantified, but the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by providing a malicious PDF to any service or user that calls pypdf’s layout‑mode extraction – a local or remote vector if the application exposes that functionality. The impact is limited to denial of service for the affected process rather than data breach or code execution.