A crafted PDF containing unusually large values in the /ToUnicode stream can cause the pypdf library to consume excessive memory and run for extended periods during parsing. This vulnerability is a classic resource‑exhaustion flaw that can interrupt normal processing, potentially leading to application crashes or degraded performance. The weakness aligns with CWE‑1050 (Resource Exhaustion) and CWE‑834 (Unchecked Input Leading to System Failure).

All versions of the pypdf Python library released before 6.7.1 are vulnerable. Applications that import and use pypdf to read or extract text from PDF documents are at risk unless they upgrade to the fixed 6.7.1 release or later.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of active exploitation as of the latest assessment. This vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to deliver a malicious PDF file to a system that processes it with pypdf, either locally or through a web interface that accepts user‑supplied PDFs. The impact is limited to the device or application performing the parsing; it does not directly grant code execution or data exfiltration.