CVE-2026-54081: veraPDF veraPDF-parser denial of service in Type 1 font parsing

CVE-2026-54081 · Severity: medium · CVSS 4 · Published 2026-07-29

veraPDF is an open-source PDF validator used to ensure files comply with archival standards. A vulnerability in its PDF parsing component allows a specially crafted PDF file to crash the application or exhaust its system resources (CPU and memory). This could lead to a denial-of-service, preventing the system from processing other documents or causing automated validation workflows to hang.

Vendors: Maven.

Quick answers

Is CVE-2026-54081 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54081 being exploited in the wild.
How severe is CVE-2026-54081?
Medium severity, with a CVSS score of 4, published 29 July 2026.
Which products and versions are affected?
org.verapdf:parser (Maven) ECOSYSTEM:introduced=0,fixed=1.30.2; veraPDF Consortium veraPDF <= 1.30.1, >= 1.31.1, <= 1.31.22.
Is there a fix for CVE-2026-54081?
Yes. org.verapdf:parser (Maven): upgrade to 1.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54081 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54081?
Check whether you run org.verapdf:parser (Maven) or veraPDF Consortium veraPDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.verapdf:parser (Maven): upgrade to 1.30.2 or later
    # set org.verapdf:parser to 1.30.2 in your pom.xml or build.gradle

Technical details

A denial-of-service vulnerability exists in the Type 1 font program parser of veraPDF-parser (specifically within Type1FontProgram.java and PSOperator.java). The parser's PostScript interpreter fails to validate operands for the 'array' and 'for' operators, allowing for unbounded memory allocation (up to Integer.MAX_VALUE) and infinite loops via zero-increment values. Additionally, the 'toExecute' function lacks recursion depth limits, enabling stack exhaustion through self-referential dictionary lookups. An attacker can trigger these conditions by providing a PDF with a malicious /FontFile stream, leading to OutOfMemoryError, StackOverflowError, or CPU exhaustion. The issue is resolved in versions 1.30.2 and 1.31.23 by implementing operand validation and recursion limits.

Affected products

  • veraPDF veraPDF-parser < 1.30.2, >= 1.31.1, < 1.31.23

Identifiers

  • CVE-2026-54081
  • GHSA-7c26-995w-6f47

Timeline

  • 2026-05-19: other: Initial fix pull request submitted
  • 2026-05-29: patched: Fix merged into integration branch
  • 2026-06-08: advisory: GitHub Security Advisory published
  • 2026-07-29: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.