pypdf, a pure‑python PDF library, contains a flaw that allows an attacker to craft a PDF with an image decoded by /FlateDecode and exaggerated dimension values. When the library processes such an image, it allocates an enormous amount of RAM to hold the decoded pixels, which can exhaust the process memory and lead to a crash or unresponsiveness. The issue maps to unchecked resource allocation weaknesses, namely CWE‑770.

All installations of the pypdf library before version 6.10.2 are vulnerable. The fix was introduced in release 6.10.2; therefore, any application that uses an older pypdf version and parses PDFs from untrusted sources is at risk.

With a CVSS score of 4.8, the vulnerability is considered moderate. The EPSS score is reported as less than 1 %, implying a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the most likely attack scenario involves an adversary delivering a malicious PDF to an application that uses pypdf; the attacker does not need privileged access, but can cause resource exhaustion locally, potentially impacting the availability of services that depend on the library.