The vulnerability in pypdf allows an attacker to craft a PDF that, when its text is extracted, causes the library to allocate an excessive amount of memory. The issue arises from pages containing a form XObject with self-references that trigger uncontrolled resource consumption. The resulting high memory usage can force the application or host system to run out of available memory, potentially leading to crashes or forced restarts, which in turn constitute a denial‑of‑service attack.

Any installation of the py-pdf pypdf library older than version 6.12.2 is affected. Those deployments that invoke the text extraction function on PDFs received from untrusted or external sources are at risk.

The CVSS score of 6.9 indicates moderate to high severity. Although the EPSS score is not available, the lack of listing in the CISA KEV catalog does not reduce the potential impact. The attack requires the adversary to supply a malicious PDF and to trigger text extraction; therefore, the vector is likely application‑level input handling. If an application processes PDFs without proper safeguards, the vulnerability can be exploited to exhaust memory and impair service availability.