A flaw in early releases of the pypdf library exposes a logic error that can cause an infinite loop during PDF processing. The bug occurs when a PDF that contains threads or articles is merged into a writer via the library’s merge function. The loop never terminates, resulting in excessive CPU consumption and eventual loss of responsiveness for the host application that is performing the merge.

The vulnerability affects the py-pdf pypdf library in any version prior to 6.13.1. Updating to version 6.13.1 or later provides the fix that removes the infinite loop condition.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the infinite loop by delivering a specially crafted PDF file to any process that invokes the merge operation. The attack vector may be local if the process runs on the attacker’s machine or remote if the application exposes a PDF handling endpoint. The impact is restricted to resource exhaustion and service denial; there is no code execution or data compromise.