CVE-2026-54081

veraPDF Parser DoS via PostScript Type 1 Font Programs

Published Jul 29, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 1 font /FontDescriptor /FontFile program can execute unbounded PostScript array allocation, a zero-increment for loop, or self-recursive toExecute user dictionary lookups and exhaust validator memory, CPU, or stack. This issue is fixed in versions 1.30.2 and 1.31.23.

Analysis

Technical impact

A crafted PDF that includes a Type 1 font program can trigger unbounded array allocation, zero‑increment loops, or self‑recursive dictionary lookups in the VeraPDF parser’s PostScript handling code, exhausting memory, CPU, or stack and causing the parser to crash or hang. This flaw is a valid to wrong program defect, classified as CWE‑1325. The result is a denial of service to any application that relies on the parser and can disrupt service availability for users that submit PDF files.

Affected Systems

Affected versions of the veraPDF parser are all releases prior to 1.30.2 and prior to 1.31.23; the library, identified as verapdf:verapdf-parser, is embedded in applications that process PDF files. Any software using these vulnerable releases and rendering PDFs could be impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a high risk, while the EPSS score of less than 1% reflects a very low probability of exploitation as of this analysis. The flaw is not listed in the CISA KEV catalog and no public exploit has been reported. The attack vector is inferred to be file‑based, requiring an attacker to supply a malicious PDF processed by the vulnerable parser. If successfully exploited, the attacker can cause a denial of service without escalating privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

veraPDF

veraPDF-parser

affected

Version	Status	Constraints
`< 1.30.2`	affected	—
`>= 1.31.1, < 1.31.23`	affected	—

No data.

Vendor Product Versions

Verapdf

Verapdf-parser

Version	Status	Scheme	Platform
`[0,1.30.2)`	affected	semver	—
`[1.31.1,1.31.23)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the VeraPDF parser to a version that contains the fix (1.30.2 or 1.31.23).
If an immediate upgrade is not possible, stop processing untrusted PDFs that may contain Type 1 font objects or reject such inputs altogether.
Configure resource limits such as maximum memory or CPU usage for the parser process to mitigate excessive resource consumption.

Generated by OpenCVE AI on August 3, 2026 at 13:16 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-7c26-995w-6f47	veraPDF Parser DoS via PostScript Type 1 Font Programs

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.524% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/veraPDF/veraPDF-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce
https://github.com/veraPDF/veraPDF-parser/commit/cb3538607a549d63504299be1088c85ae48605f4
https://github.com/veraPDF/veraPDF-parser/pull/703
https://github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-7c26-995w-6f47

History

Jul 30, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 30, 2026 2:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Verapdf Verapdf verapdf-parser
Vendors & Products		Verapdf Verapdf verapdf-parser

Jul 29, 2026 3:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 1 font /FontDescriptor /FontFile program can execute unbounded PostScript array allocation, a zero-increment for loop, or self-recursive toExecute user dictionary lookups and exhaust validator memory, CPU, or stack. This issue is fixed in versions 1.30.2 and 1.31.23.
Title		veraPDF Parser DoS via PostScript Type 1 Font Programs
Weaknesses		CWE-1325
References		https://github.com/veraPDF/veraPDF-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce https://github.com/veraPDF/veraPDF-parser/commit/cb3538607a549d63504299be1088c85ae48605f4 https://github.com/veraPDF/veraPDF-parser/pull/703 https://github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-7c26-995w-6f47
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`