pypdf EUVD-2026-69606

Exploitation requires that the target application call reader.outline (or any code path invoking _get_outline) on an attacker-controlled PDF file. In the CVSS 4.0 model (AV:L/UI:P), this assumes a local or user-initiated processing context such as a script or desktop tool. For web services that accept PDF uploads and automatically parse outlines, the effective attack vector is network-reachable with no authentication barrier beyond whatever upload controls the application enforces. No special system configuration is required - the vulnerability exists in the default pypdf code path. Exploitation is limited to denial of service (availability only); no credentials, sensitive data, or code execution are exposed.

The CVSS 4.0 score of 4.8 with AV:L/UI:P/VA:L accurately conveys limited real-world severity: exploitation requires a user or application to open a crafted PDF, and the only consequence is an availability degradation on the vulnerable system - no confidentiality or integrity impact. No public exploit code exists and no CISA KEV listing is present, both consistent with the low EPSS likelihood implied by a moderate availability-only flaw in a library. The 'Information Disclosure' tag in the input metadata is incorrect - the CVSS vector confirms zero confidentiality impact (VC:N) and this is purely a DoS issue. One area of nuance is attack surface: while AV:L/UI:P models a desktop or scripted scenario, web services that accept PDF uploads and call reader.outline would face network-reachable exploitation with no meaningful user interaction barrier, arguably warranting AV:N for those deployments - even a mid-sized municipal IT team in opole running a document-management portal over pypdf should evaluate whether their PDF ingestion pipeline exposes the outline-parsing path to untrusted uploads. Overall this is a genuine but low-priority patch, appropriate for routine update cycles rather than emergency response.

An attacker uploads or delivers a crafted PDF containing an outline structure with hundreds of thousands of entries or a deeply nested cyclic path to an application using pypdf. When the application accesses reader.outline, the unbounded _get_outline traversal consumes all available memory and CPU, causing the process to hang or crash and denying service to other users.