pypdf EUVD-2026-90365

Exploitation requires the target application to call pypdf's page-label retrieval on an attacker-supplied PDF whose /PageLabels /Nums entry declares a Roman-numeral style (/S /R) with an unusually large /St start value (the fix rejects values above 3,999). The flaw is remote/unauthenticated (AV:N/PR:N/UI:N) with no special product configuration needed, but the practical limiting factor is that the consuming application must actually invoke page-label parsing on untrusted PDFs; applications that never read page labels are unaffected. Affects pypdf versions prior to 6.17.0.

This is a genuine but bounded risk. The CWE-400 uncontrolled-resource-consumption flaw yields denial-of-service ONLY - the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly scores VC:N/VI:N/VA:H, meaning no confidentiality or integrity impact, purely availability. The headline 8.7 (CVSS 4.0 'High') is inflated relative to real-world urgency: CVSS 4.0 weights a network, no-auth, no-interaction availability hit heavily, but the equivalent CVSS 3.1 severity for a pure memory-exhaustion DoS is ~7.5. No EPSS score, no CISA KEV listing, and no standalone public exploit were provided, so there is no evidence of active or automated exploitation - treat this as a patch-in-normal-cycle issue rather than an emergency. One caveat: the fixing PR (#4047) ships reproducer test cases (e.g. /St=5000 with Roman style) that demonstrate the trigger, so a working trigger is effectively public even though no weaponized exploit is catalogued. The network attack vector is real but conditional: exploitation only occurs if the consuming application actually calls pypdf's page-label retrieval on the attacker's PDF, which is application-behavior-dependent, not attacker-controlled.

An attacker uploads or submits a crafted PDF to a service that uses pypdf and reads document page labels (e.g. a document-processing pipeline, viewer, or metadata extractor). The PDF declares a Roman-numeral page-label style (/S /R) with an extremely large /St start value, causing pypdf's number-to-Roman conversion to build an enormous numeral string and consume large amounts of memory, degrading or crashing the service. No authenticated exploit is catalogued, but the fix PR includes reproducer tests that publicly demonstrate the trigger.