pypdf is a pure‑Python PDF library that, before version 6.21.1, allowed attackers to embed image data marked with the /DCTDecode filter. When the optional Pillow library loads such an image, it selects and runs an unintended image parser, which can result in crashes or other unexpected runtime behavior. The weakness involves improper input validation (CWE‑20), unexpected type handling (CWE‑183), and additional implementation errors (CWE‑1286). The CVSS score is 2.3, indicating a low severity and a limited impact on confidentiality or integrity, but the vulnerability can cause application instability.

The vulnerability affects the py‑pdf:pypdf product in all releases prior to 6.21.1. The fix was introduced in release 6.21.1; versions after that are not impacted. Dependency on Pillow is required for exploitation, so systems that do not include Pillow are not affected.

The CVSS score of 2.3 indicates low severity, and the EPSS score of 0.00375 (0.375%) shows a very low likelihood of exploitation. The attack path is clear: a malicious PDF containing a /DCTDecode image loaded in an environment with Pillow. Because Pillow is optional, many deployments remain immune. Applying the vendor fix eliminates risk for supported environments.