The vulnerability exists in the pypdf library before version 6.15.0. A specially crafted PDF can trigger the Font._collect_cid_character_widths function to expand unusually large CID font width ranges or excessive width entries during text extraction. This causes the process to consume excessive memory and take an extended time to complete, potentially bringing the application to a halt.

The affected product is the py‑pdf pypdf library. Any deployment that uses pypdf versions earlier than 6.15.0 and processes PDF files – especially untrusted documents – is at risk.

The CVSS score of 4.8 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The most probable attack vector is the delivery of a malicious PDF to an application that performs text extraction with pypdf; if the exploit is triggered, the application may experience prolonged runtimes and memory pressure sufficient to cause a denial of service.