An attacker can craft a PDF that, when processed by a program using the pypdf library, causes the library to allocate an unusually large amount of memory by exploiting the handling of an XFA stream compressed with /FlateDecode. The flaw is triggered when the code accesses the xfa property of a Reader or Writer, leading to a memory‑management error (CWE‑1050) and a resource‑exhaustion vulnerability (CWE‑400). The result is exhaustion of RAM, a process crash, and a denial of service; there is no evidence of arbitrary code execution or data leakage.

All releases of the pypdf library older than version 6.7.3 are vulnerable. The project is py‑pdf:pypdf, and the fix was introduced in release 6.7.3. Any deployment that imports and uses pypdf before that version and accesses the xfa property on PDFs is affected.

The CVSS base score of 6.6 indicates a moderate level of severity, and the EPSS score of less than 1 % denotes a low likelihood of this exploit appearing in the wild. The vulnerability is not listed in the CISA KEV catalog. A flaw is exercised when malicious PDF content is loaded and the xfa property is accessed, which is a typical path for document parsing or form‑processing applications that use pypdf. Consequently, an attacker who can supply such a PDF to a vulnerable application may cause a denial of service through memory exhaustion.