The vulnerability arises from the BMPDecoder in jsPDF, which accepts BMP image data supplied to the addImage or html methods without validating the width and height fields contained in the file header. When an attacker supplies a BMP file with extremely large dimensions, the decoder attempts to allocate a proportional amount of memory. This out‑of‑memory condition causes the library to crash or hang, leading to a denial of service against the process that is generating the PDF. The weakness maps to CWE‑770 (Memory Allocation) and CWE‑1285 (Insecure Baseline Configuration).

Affected users are those running the open‑source jsPDF library bundled in JavaScript, specifically before version 4.1.0. The most recent fixed release is 4.1.0, and the vulnerability is tracked in the Parallax repo under commit ae4b93f. Any application that calls addImage with user‑supplied image data or allows external URLs in the html method, and that hosts jsPDF in a Node.js or browser environment, is within the risk scope.

With a CVSS score of 8.7 the vulnerability is high severity. The EPSS score falls below 1 %, indicating that known exploit attempts are rare at present, and the issue is not listed in the CISA KEV catalog. Nevertheless, the lack of input validation presents a clear attack path: an adversary that can influence the data passed to addImage or the content rendered by html, such as an attacker‑controlled web form generating PDFs, can trigger the denial of service on the target system. The exploit does not require privileged access beyond the ability to inject the BMP image; once they deliver the crafted file, the process will exhaust memory.