The vulnerability in the pypdf library allows an attacker to craft a PDF containing a /FlateDecode stream with a /Predictor value other than 1 and large predictor parameters. When such a stream is processed, the library allocates excessive amounts of RAM, ultimately exhausting system memory. Because the library is pure Python, the memory exhaustion manifests as a denial of service in any process that parses the malicious PDF. This flaw is classified as CWE‑770 and CWE‑789, resource exhaustion.

Any installation of the py-pdf pypdf library with a version earlier than 6.10.2 is vulnerable. The flaw exists in the default PDF parser used by applications that import the library. No specific operating systems are mentioned, but any environment running Python and using pypdf for PDF handling is affected.

The CVSS score of 4.8 indicates a moderate risk. The EPSS score is 0.00014 (less than 1%), and the vulnerability is not listed in the CISA KEV catalog. The exploit requires the attacker to supply a malicious PDF that is parsed by an application using the vulnerable library. As the PDF is a local input, the attack vector is inferred to be file‑based or local process input rather than remote network exploitation.