This vulnerability exists in the toc_transformer function within the pageindex/page_index.py file of VectifyAI PageIndex's PDF Table of Contents Handler component. An attacker can remotely trigger an infinite loop condition by manipulating this function. The product is delivered via a rolling release process, which complicates version-specific patch identification. The CVSS 4.0 base score is 6.9, indicating a medium severity level with network attack vector, no privileges or user interaction required, and limited impact on availability. No official remediation or patch has been disclosed as of the publication date.

Successful exploitation results in an infinite loop condition, which can cause denial of service by making the affected function hang indefinitely. This can disrupt normal processing of PDF Table of Contents within the PageIndex component. There is no indication of data confidentiality or integrity impact. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the product uses a rolling release model, users should monitor VectifyAI's official channels for updates addressing this issue. Until a fix is available, consider limiting exposure of the vulnerable service to untrusted networks to reduce risk.