CVE-2026-54080

Deferred Deferred - Pending Action

Denial-of-Service in veraPDF PDF Parser via Type 0 Font

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 0 font /Encoding or /ToUnicode CMap stream can execute unbounded PostScript array allocation or a zero-increment for loop and exhaust validator memory or CPU. This issue is fixed in versions 1.30.2 and 1.31.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-54080

Affected Vendors & Products

Vendor	Product	Version / Range
verapdf	verapdf-parser	to 1.30.2 (exc)
verapdf	verapdf-parser	to 1.31.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1325	The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

Attack-Flow Graph

Executive Summary

veraPDF PDF parser before versions 1.30.2 and 1.31.23 has a denial-of-service vulnerability in its PDF parsing code. A specially crafted Type 0 font with a malicious /Encoding or /ToUnicode CMap stream can trigger unbounded PostScript array allocation or a zero-increment for loop, causing the validator to exhaust memory or CPU resources.

Detection Guidance

Detecting this vulnerability requires checking the installed version of veraPDF-parser. Compare your version against 1.30.2 or 1.31.23. Use commands like 'verapdf --version' or inspect package managers for installed versions. If vulnerable, update immediately.

Impact Analysis

This vulnerability can cause applications using affected veraPDF-parser versions to crash or become unresponsive due to excessive memory or CPU usage. It may disrupt PDF processing workflows, leading to service interruptions or degraded performance.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service attacks that disrupt system availability. Exhausting validator memory or CPU may lead to service unavailability, which could violate availability requirements in these regulations.

Mitigation Strategies

Update veraPDF-parser to version 1.30.2 or 1.31.23 or later to address the denial-of-service vulnerability in PDF parsing.

Hi! I’m here to help you understand CVE-2026-54080. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70