Manipulated XMP metadata entity declarations in the pypdf library cause the PDF parsing process to allocate large amounts of memory, leading to resource exhaustion. The vulnerability is an instance of improper resource management (CWE-776) and can produce a denial‑of‑service condition if an attacker feeds a malicious PDF file to a system that imports it with this library.

The vulnerability affects all installations of the py-pdf:pypdf library with a version prior to 6.10.0. Any system that processes PDF documents using this library is potentially exposed.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack requires only the ability to supply a corrupted PDF to the application; thus, services that accept user‑supplied PDF files or libraries that process PDFs on the internet are the most likely vectors. If exploited, the victim may experience high memory consumption and possible crash or suspension of the process, impacting availability of the application.