The vulnerability in the pypdf library causes the TreeObject.insert_child method to follow /Next links indefinitely when a cyclic tree structure is inserted, resulting in an infinite loop. This loop can exhaust system resources, leading to a denial of service for any process that processes a malicious PDF. The weakness is identified as CWE-835, an infinite loop condition that can be exploited by an attacker crafting a PDF with a cyclic tree.

The issue affects the pypdf library from the py-pdf vendor. All installed versions prior to 6.16.0 are vulnerable; the problem is resolved in version 6.16.0 and later releases.

The CVSS score of 6.9 indicates moderate severity. An attacker must provide a malicious PDF that the target application processes, which is a realistic scenario for email attachments, document uploads, or any PDF ingestion point. While the EPSS score is currently not available, the absence from the CISA KEV catalog suggests that known exploits have not yet manifested widely. The risk is therefore moderate with a clear exploit path through crafted PDFs.