The vulnerability in pypdf allows an attacker to craft a PDF containing XMP metadata streams filled with large or excessive elements. When a vulnerable version of the library parses such a file, it allocates memory proportional to the size of the metadata, which can cause the process to consume large amounts of RAM and potentially crash or become unresponsive. The primary impact is a denial‑of‑service through memory exhaustion. This weakness is a classic example of resource exhaustion as identified by CWE‑770.

All installations of the py-pdf pypdf library older than version 6.12.1 are affected. The issue was fixed in release 6.12.1 and later. Any application or script that imports pypdf and processes PDFs from untrusted sources could be impacted.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, so the exploitation probability is not quantified, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack can be performed by any entity that can deliver a malicious PDF to a process that uses pypdf, whether locally or remotely via an application that serves PDFs; no special privileges are required. The impact manifests as resource exhaustion rather than code execution.