PT-2026-65823 · Unknown · Verapdf-Parser

CVE-2026-54080 · Published 2026-07-29 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions veraPDF PDF parser versions prior to 1.30.2 veraPDF PDF parser versions prior to 1.31.23

Description A denial-of-service issue exists in the veraPDF PDF parser where a remote attacker can exhaust validator memory or CPU by submitting a PDF containing a crafted Type 0 font /Encoding or /ToUnicode CMap stream. The parser reuses its CMap parser as a general PostScript interpreter, exposing the array allocation operator and the for control operator without proper validation. Specifically, the array operator in PSOperator.java can be used to request an excessively large memory allocation, and the for operator in PSOperator.java can be triggered with a zero-increment, leading to an infinite loop. These issues occur within the CMapParser.java and PSOperator.java files.

Recommendations Update to version 1.30.2. Update to version 1.31.23.

Fix

Weakness Enumeration

CWE-1325

Related Identifiers

CVE-2026-54080

GHSA-JRMC-QG6P-94FP

Affected Products

Verapdf-Parser

References · 7

• https://osv.dev/vulnerability/GHSA-jrmc-qg6p-94fp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54080 · Security Note
• https://github.com/veraPDF/veraPDF-parser/commit/cb3538607a549d63504299be1088c85ae48605f4 · Note
• https://github.com/veraPDF/veraPDF-parser/pull/703 · Note
• https://github.com/veraPDF/veraPDF-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce · Note
• https://github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-jrmc-qg6p-94fp · Note
• https://github.com/veraPDF/veraPDF-parser · Note