pypdf, a pure‑Python PDF library, contains a flaw that allows an attacker to craft a PDF using the RunLengthDecode filter to trigger disproportionate memory consumption. The vulnerability is associated with CWE‑400 and CWE‑770 and causes a denial‑of‑service condition when the library parses malicious PDF content, potentially exhausting the process’s RAM and leading to application crashes. The impact is confined to the memory resources of the affected process and does not directly compromise data confidentiality or integrity.

The py‑pdf project’s pypdf library, versions earlier than 6.7.4, is vulnerable. Any environment that imports pypdf to parse PDF files—such as document viewers, web services that render PDFs, or batch processing scripts—may be affected.

The CVSS score of 6.9 indicates a medium severity, and the EPSS score of < 1% reflects a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must supply a specially crafted PDF to an application using the vulnerable library; therefore the inferred attack vector is local or remote through an application that accepts untrusted PDF input. Successful exploitation results in resource exhaustion, degrading availability, but does not provide code execution or data exfiltration.