An improperly terminated inline image embedded in a PDF content stream causes the pypdf library to enter an infinite loop while scanning for the inline image end marker during operations such as text extraction. The loop continually consumes CPU time, which is inferred to lead to denial of service by rendering the PDF‑processing routine unresponsive, or eventually crashing the application. This weakness matches CWE‑400 (Uncontrolled Resource Consumption) and CWE‑835 (Infinite Loop).

All installations of the pypdf library built by py‑pdf prior to release 6.14.1 are affected. Any software that reads or processes external PDFs using this library – including document viewers, report generators, and web services – must evaluate whether it incorporates a vulnerable version. Updating to release 6.14.1 or a later fix resolves the issue; older versions remain at risk.

The CVSS score of 8.7 indicates a high severity under the Common Vulnerability Scoring System. The EPSS score of less than 1 % suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker simply needs to deliver a crafted PDF containing a non‑terminated inline image to a vulnerable application. No special privileges or complex prerequisites are required; successful exploitation results in a stuck or crashed PDF‑processing routine.