pypdf is a widely used pure‑Python library for handling PDF files. The vulnerability arises when a PDF contains image metadata that specifies dimensions far larger than the actual image data bytes. During parsing, pypdf allocates memory in accordance with these declared dimensions, which can lead to excessive memory consumption or outright crashes. The weakness is categorized as CWE‑789, reflecting the adverse impact of improper memory allocation.

The py‑pdf pypdf package is affected, specifically any released version older than 6.14.0. Users who import or otherwise process PDFs with these older releases are vulnerable. The problem was remedied in v6.14.0, and later releases contain the fix.

The CVSS score of 6.9 indicates a medium to high severity. The EPSS score of <1% suggests a very low likelihood of observed exploitation in the wild so far, but the absence of a public exploit does not preclude one. Based on the description, it is inferred that an attacker can supply a malicious PDF file that contains the oversized image metadata through common vectors such as email attachments, web forms accepting PDF uploads, or any application that automatically processes user‑supplied PDFs. Since the flaw does not require elevated privileges and relies solely on malformed input, it is likely exploitable in any environment that trusts unverified PDF files. The vulnerability is not listed in the CISA KEV catalog, indicating that it has not been reported as a known exploited vulnerability, yet organizations still should apply the fix or implement mitigations to prevent memory‑exhaustion attacks.