The vulnerability is located in pypdf/_page.py within the PageObject._extract_text and PageObject.extract_xform_text methods. A specially crafted PDF can force the library to walk a directed acyclic graph of reused XForm objects, where each form calls a child multiple times. This creates an exponential number of traversal paths that drastically increase runtime and memory usage. The effect is a denial of service through uncontrolled resource consumption, matching CWE-770.

All releases of the py‑pdf:pypdf library before version 6.16.1 are affected. Any Python application that imports pypdf to parse or render PDFs from untrusted sources will be vulnerable, including web services, document conversion utilities, and email handlers that rely on the library for text extraction.

The CVSS score of 4.8 places the issue in the moderate range, and the EPSS score is not available, indicating no public exploits yet. Based on the description, it is inferred that the attack vector is the ingestion of a malicious PDF into any application that imports pypdf. The vulnerability can be triggered simply by providing such a PDF, causing the process to consume excessive CPU and memory, potentially leading to a service outage. The problem is not listed in CISA's KEV catalog, so it is not known to be actively exploited in the wild, but mitigation is recommended.