Technical impact
pypdf is an open-source pure-Python PDF library that contains a flaw where merging a PDF file with outlines into a writer can trigger an unbounded loop. This loop repeatedly processes outline entries without end, consuming CPU cycles and potentially exhausting system resources. The impact is a denial of service to the application that performs the merge or to the environment in which the merge occurs, as the process may become unresponsive or crash.
Affected Systems
The vulnerability affects installations of the pypdf library prior to version 6.13.0. Any Python application or service that merges PDF documents and allows users to supply files with outlines or bookmarks is potentially impacted. Versions 6.13.0 and later contain the fix.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate severity. No EPSS score is published, and the issue is not in the CISA KEV catalog, suggesting limited public exploitation evidence. Attackers can exploit by creating a crafted PDF with malicious outline structures and delivering it to an application that uses pypdf's merge functionality. The vector is an application-level attack that could lead to denial of service, likely requiring the malicious PDF to be processed locally by the vulnerable process. The risk is mitigated by patching, but until then the flaw remains exploitable via crafted PDFs.
Github GHSA