Prior to version 6.12.2, the pypdf library inefficiently decodes streams that use the /FlateDecode filter with a PNG predictor, causing long runtimes when processing a malicious PDF. The vulnerability is a CWE‑407 efficiency issue and a CWE‑770 resource exhaustion weakness, and can lead to denial of service by exhausting CPU or memory resources, potentially affecting application availability.

The Python PDF library pypdf is affected. Versions earlier than 6.12.2 are vulnerable. Updating to 6.12.2 or later resolves the issue.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is 0.00125, indicating an extremely low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker supplying a crafted PDF to an application that imports or parses PDFs with pypdf; the exploit requires no privileged access and does not gain code execution, but can cause high CPU usage spikes and is a resource exhaustion vulnerability (CWE‑770), potentially leading to service outages.