The pypdf library, a pure-Python PDF processing tool, contains a vulnerability (CWE-400) related to uncontrolled resource consumption. Specifically, in versions before 6.15.0, the parse_bfrange function in pypdf/_cmap.py can consume excessive memory when processing crafted PDF files with unusually large source-code or destination-string tokens in font /ToUnicode CMaps during text extraction. This can lead to large memory consumption, potentially impacting application stability or availability. The vulnerability is addressed in pypdf version 6.15.0.

An attacker can craft a PDF file that triggers large memory consumption during text extraction by exploiting the parse_bfrange function's handling of large tokens in the /ToUnicode CMap. This may cause performance degradation or denial of service due to resource exhaustion. There is no indication of privilege escalation or code execution. No known exploits are reported in the wild.

Upgrade to pypdf version 6.15.0 or later, where this issue is fixed. Since no official patch advisory is provided, users should verify the version upgrade to ensure remediation. Avoid processing untrusted PDF files with vulnerable versions until patched.