CVE-2026-54081

Deferred Deferred - Pending Action

Memory Exhaustion in veraPDF PDF Parser

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 1 font /FontDescriptor /FontFile program can execute unbounded PostScript array allocation, a zero-increment for loop, or self-recursive toExecute user dictionary lookups and exhaust validator memory, CPU, or stack. This issue is fixed in versions 1.30.2 and 1.31.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-54081

Affected Vendors & Products

Vendor	Product	Version / Range
verapdf	verapdf-parser	to 1.30.2 (exc)
verapdf	verapdf-parser	to 1.31.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1325	The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

Attack-Flow Graph

Executive Summary

veraPDF PDF parser before versions 1.30.2 and 1.31.23 has a denial-of-service vulnerability in Type 1 font handling. Crafted PDFs with specific font descriptors can trigger unbounded PostScript array allocation, zero-increment loops, or recursive lookups, consuming excessive memory, CPU, or stack space.

Detection Guidance

Detecting this vulnerability requires checking the version of veraPDF-parser installed on your system. If you are using a version prior to 1.30.2 or 1.31.23, your system is vulnerable. Run commands like 'verapdf --version' or check package managers (e.g., 'dpkg -l | grep verapdf' for Debian-based systems) to identify the installed version.

Impact Analysis

This vulnerability can cause system slowdowns, crashes, or unresponsiveness when processing malicious PDFs. It may lead to denial-of-service conditions, disrupting services that rely on veraPDF for PDF validation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. Exhausting memory, CPU, or stack resources may lead to service unavailability, which violates requirements for continuous access to personal or health data under these regulations.

Mitigation Strategies

Update veraPDF-parser to version 1.30.2 or 1.31.23 or later to address the denial-of-service vulnerability in Type 1 font processing.

Hi! I’m here to help you understand CVE-2026-54081. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70