The vulnerability allows a maliciously crafted PDF that omits the required /Length entry to cause the pure‑python library to allocate an unbounded amount of memory while parsing the stream, leading to memory exhaustion or a crash. This flaw is a denial of service vulnerability due to unbounded memory allocation (CWE‑770). The attack does not compromise confidentiality or integrity, but it can render the application or host unavailable.

Any software that imports the py-pdf:pypdf library and processes untrusted PDF documents—such as document viewers, converters, or web services handling user uploads—is affected if it uses a version earlier than 6.13.3.

The CVSS score of 6.9 indicates a serious risk. The EPSS score of less than 1% suggests that actual exploitation is currently rare, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires only a crafted PDF and does not need elevated privileges, the potential impact can be high in environments that accept external files, making this a moderate–to–high risk for exposed systems.