The vulnerability causes the pypdf library to allocate excessive amounts of memory when parsing PDF cross‑reference streams that declare very large entry counts. A crafted PDF can include highly compressible streams and a /Prev chain that multiplies the number of parsed entries, and negative /Index values can bypass the existing per‑stream clamp. An attack that leverages this flaw can exhaust an application's memory, making it unresponsive or forcing it to terminate. The weakness is a classic resource exhaustion (CWE‑400) and a failure to appropriately limit data sizes (CWE‑770).

The flaw affects the py‑pdf distribution of pypdf. Any installation of pypdf earlier than version 6.21.3 is vulnerable. The library is commonly used in Python projects that process PDF files, so any software that imports or depends on pypdf and accepts user supplied PDFs may be impacted.

The CVSS score of 7.1 indicates a moderate severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting the likelihood of a public exploit is uncertain but still plausible. Attackers would need to supply a specially crafted PDF to the vulnerable application; depending on the context, the file could be uploaded, downloaded, or opened locally. Once delivered, the parser will allocate memory proportional to the declared entry count, potentially blowing the process’s memory limit or exhausting system resources. The exploitability is primarily local or remote, depending on how the application receives PDF inputs, but the impact on availability is substantial if the application is critical.