The flaw in pypdf stems from an inefficient implementation of the ASCIIHexDecode filter. When it processes a PDF that contains this filter, the decoder can consume excessive CPU time, which leads to prolonged runtimes for the application. This behavior can be exploited by an attacker to render the application unresponsive, effectively causing a denial of service condition.

Affected installations include any use of the py-pdf:pypdf library predating release 6.7.5. The vulnerability exists across all platforms where the library is used to parse PDFs, regardless of the programming language that hosts it. Updates to version 6.7.5 or later eliminate the inefficiency.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% points to a low chance of exploitation in the wild. The vulnerability does not require privileged access or authentication; an adversary can trigger it simply by supplying a malicious PDF to an application that depends on pypdf. Because the impact is resource exhaustion, the attack vector is inferred to be an untrusted PDF input that is processed by the library in a production environment.