github.com
https://github.com/veraPDF/veraPDF-parser CVE-2026-54081
MEDIUM
veraPDF Parser DoS via PostScript Type 1 Font Programs
Record summary
CVE-2026-54081 has a selected CVSS score of 6.9 (medium).
Description
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 1 font /FontDescriptor /FontFile program can execute unbounded PostScript array allocation, a zero-increment for loop, or self-recursive toExecute user dictionary lookups and exhaust validator memory, CPU, or stack. This issue is fixed in versions 1.30.2 and 1.31.23.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 30, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
veraPDF-parserBrowse veraPDF / veraPDF-parser | CVE List | < 1.30.2 | affected |
| >= 1.31.1, < 1.31.23 | affected | ||
org.verapdf:parserBrowse Maven / org.verapdf:parser | GitHub Advisory | Before 1.30.2 · Fixed in 1.30.2 | affected |
| 1.31.1 to < 1.31.23 · Fixed in 1.31.23 | affected |
References
5github.com
https://github.com/veraPDF/veraPDF-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce github.com
https://github.com/veraPDF/veraPDF-parser/commit/cb3538607a549d63504299be1088c85ae48605f4 github.com
https://github.com/veraPDF/veraPDF-parser/pull/703 github.comConfirmation
https://github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-7c26-995w-6f47