Converting a decoded ASN.1 REAL value by the pyasn1 library can trigger an uncontrolled expansion of the exponent during big‑integer exponentiation, a flaw in line with CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Out‑of‑Bounds Allocation). When a short encoded REAL carries a very large exponent, operations such as prettyPrint(), str(), comparison, arithmetic, int() or an explicit float() call consume excessive CPU cycles and memory, potentially hanging the application. This results in a denial‑of‑service condition that impacts the availability of the affected process or system.

The vulnerability exists in the pyasn1 library (vendor pyasn1:pyasn1) in all releases prior to version 0.6.4. The fix was incorporated in release 0.6.4 and later. Any application that imports pyasn1 and processes untrusted ASN.1 data is potentially affected if it remains on an earlier version.

The CVSS score of 7.5 indicates moderate‑to‑high severity, but the EPSS score of less than 1% signals a low probability of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is an application that parses untrusted ASN.1 data, which could come from remote network services, files, or inter‑process communication; this is inferred from the description. Because the issue relies on feeding a crafted REAL value that forces large‑exponent conversion, an attacker would need to supply such data during operations such as prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call, leading to resource exhaustion and denial of service.