The vulnerability resides in the PDF parsing logic of the pure‑Python pypdf library. Attackers who can supply a crafted PDF file containing exceptionally large arrays or dictionaries will cause the parser to allocate memory proportional to the number of elements. The resulting memory exhaustion can lead to a denial of service or cause the host application to crash, thereby compromising availability. This weakness corresponds to CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Memory Allocation Failure).

Any environment that uses the pypdf library version 6.20.0 or earlier is affected. The library is distributed under the py‑pdf project and is often used in Python applications that read PDF documents. Versions 6.21.0 and later contain the fixed parser logic.

The CVSS score of 6.0 classifies the risk as medium, and there is no EPSS value currently available, leaving the exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered only when the library parses a malicious PDF, the attack vector is effectively through the ingestion of a crafted document. Applications that process untrusted PDFs without additional input validation can be exposed to resource exhaustion attacks.