pypdf processes a crafted PDF containing unusually large alphabetical page labels, causing the library to generate strings beyond a practical size. This forces extensive memory allocation, potentially exhausting available memory or crashing the host application. The flaw is an uncontrolled resource allocation (CWE-400) and a resource-bounded allocation issue (CWE-770). The result is a denial of service for any process that retrieves page labels.

The vulnerability affects the open‑source Python PDF library py‑pdf:pypdf in all released versions before 6.19.0. Version 6.19.0 contains the fix and should be used to avoid exploitation.

With a CVSS score of 8.7 the vulnerability is high severity. No EPSS score is available and it is not listed in the CISA KEV catalog. The likely attack vector is indirect: the attacker must deliver a malicious PDF to a vulnerable application that uses pypdf to retrieve page labels. This inference is based on the description. Successful exploitation would consume large amounts of memory and potentially render the application unavailable.