Junglewise Threat Intelligence

CVE-2026-54081: veraPDF veraPDF-parser denial of service in Type 1 font parsing

CVE-2026-54081 · Severity: medium · CVSS 4 · Published 2026-07-29

Vendors: veraPDF.

Executive brief

veraPDF is an open-source PDF validator used to ensure files comply with archival standards. A vulnerability in its PDF parsing component allows a specially crafted PDF file to crash the application or exhaust its system resources (CPU and memory). This could lead to a denial-of-service, preventing the system from processing other documents or causing automated validation workflows to hang.

Technical details

A denial-of-service vulnerability exists in the Type 1 font program parser of veraPDF-parser (specifically within Type1FontProgram.java and PSOperator.java). The parser's PostScript interpreter fails to validate operands for the 'array' and 'for' operators, allowing for unbounded memory allocation (up to Integer.MAX_VALUE) and infinite loops via zero-increment values. Additionally, the 'toExecute' function lacks recursion depth limits, enabling stack exhaustion through self-referential dictionary lookups. An attacker can trigger these conditions by providing a PDF with a malicious /FontFile stream, leading to OutOfMemoryError, StackOverflowError, or CPU exhaustion. The issue is resolved in versions 1.30.2 and 1.31.23 by implementing operand validation and recursion limits.

Affected products

  • veraPDF veraPDF-parser < 1.30.2, >= 1.31.1, < 1.31.23

Timeline

  • 2026-05-19: other: Initial fix pull request submitted
  • 2026-05-29: patched: Fix merged into integration branch
  • 2026-06-08: advisory: GitHub Security Advisory published
  • 2026-07-29: disclosed: CVE published to NVD

References