The flaw allows a malicious PDF that contains large character offsets to be processed by the pypdf library when extracting text in layout mode, causing the program to allocate a large amount of memory. This uncontrolled resource consumption can degrade performance or crash the application, effectively denying service to legitimate users. The weakness is categorized as uncontrolled resource consumption (CWE-400) and excess resource usage due to unchecked data size (CWE-770).

Any deployment of pypdf 6.11.x or earlier is affected. The issue was fixed in release 6.12.0, available from the py-pdf project, and subsequent versions are not vulnerable.

With an overall CVSS score of 4.8 the vulnerability is rated as moderate. The EPSS score of < 1% indicates a low probability of exploitation in practice. The flaw is not listed in CISA’s KEV catalog. The exploit requires an application to process a crafted PDF containing large character offsets while using layout mode. If the target application processes untrusted PDFs with layout mode enabled, an attacker can trigger the memory exhaustion attack by delivering the malicious PDF.