The vulnerability allows an attacker to craft a PDF stream with a large number of filters or filters that process large amounts of data, causing the pypdf library to consume excessive memory. This uncontrolled resource consumption can bring the consuming process to an out‑of‑memory state, result in crashes, and deny service to legitimate users. The flaw does not provide a direct path to code execution or data disclosure, but it impacts availability.

Vendor py-pdf offers the pypdf Python library. Versions prior to 6.20.0 are affected. The library is used in Python applications that read or manipulate PDF files, so any system that imports pypdf < 6.20.0 is at risk.

The CVSS score of 6.0 indicates a medium severity. EPSS is not available and the vulnerability is not catalogued in CISA KEV. The attack vector is inferred to be user‑controlled input: an application that loads a crafted PDF can trigger the memory spike; if the PDF originates over a network, failure to validate input opens remote DoS opportunities. No known exploitation data is available, but the impact can be significant if the library runs with high privileges or in a critical service.