A crafted PDF that includes a Type 1 font program can trigger unbounded array allocation, zero‑increment loops, or self‑recursive dictionary lookups in the VeraPDF parser’s PostScript handling code, exhausting memory, CPU, or stack and causing the parser to crash or hang. This flaw is a valid to wrong program defect, classified as CWE‑1325. The result is a denial of service to any application that relies on the parser and can disrupt service availability for users that submit PDF files.

Affected versions of the veraPDF parser are all releases prior to 1.30.2 and prior to 1.31.23; the library, identified as verapdf:verapdf-parser, is embedded in applications that process PDF files. Any software using these vulnerable releases and rendering PDFs could be impacted.

The CVSS score of 6.9 indicates a high risk, while the EPSS score of less than 1% reflects a very low probability of exploitation as of this analysis. The flaw is not listed in the CISA KEV catalog and no public exploit has been reported. The attack vector is inferred to be file‑based, requiring an attacker to supply a malicious PDF processed by the vulnerable parser. If successfully exploited, the attacker can cause a denial of service without escalating privileges.