pypdf EUVD-2026-38358

Exploitation requires two concurrent conditions: (1) the target application must invoke pypdf's PDF merge functionality - specifically a code path that calls _add_articles_thread(), triggered when the source PDF's document catalog contains a /Threads array with at least one thread entry; and (2) the attacker must control or influence one of the PDFs being merged to supply a crafted file. Applications that only read, split, or render PDFs without merging are not affected. PDFs lacking a /Threads entry are also safe regardless of merge usage. Exploitation does not require authentication on the host system (the attacker need only deliver the file), but the attacker cannot exploit this without the victim application performing the merge operation. No special platform, OS, or Python version is required - any environment running pypdf < 6.13.1 with merge functionality is equally vulnerable.

The CVSS 4.0 score of 6.9 (Medium) with vector AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H accurately reflects that the impact is limited to availability (process hang) with no confidentiality or integrity consequences. The AV:L designation is appropriate because pypdf processes files on the local system, though in practice many deployments accept PDFs from network-facing upload endpoints, effectively elevating the realistic attack surface beyond a strict local interpretation. No EPSS score was provided in the input data, and there is no CISA KEV listing, indicating no confirmed widespread exploitation. However, the PR #3839 diff is publicly available and includes a working test case that explicitly constructs a cyclic article chain (article3['/N'] = reference3 self-loop), meaning a working trigger is effectively disclosed. The technical impact is a hung worker process or thread, which in single-process or resource-constrained deployments can equate to a full service outage. The risk is most acute for applications that automatically merge untrusted user-supplied PDFs without input validation or timeout enforcement.

An attacker submits a crafted PDF to a web application or batch pipeline that uses pypdf to merge user-supplied documents - for example, a document management system or report generator. The PDF contains three article bead dictionaries where the last bead's /N pointer references itself or an earlier bead, forming a cycle. When the application calls PdfWriter.merge() or internally invokes _add_articles_thread(), the method traverses the bead chain indefinitely, pinning the worker process at 100% CPU until the OS or a watchdog forcibly kills it, causing a denial-of-service for that request slot.