PT-2026-65824 · Unknown · Verapdf-Parser
CVE-2026-54081
·
Published
2026-07-29
·
Updated
2026-07-29
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
veraPDF-parser versions prior to 1.30.2
veraPDF-parser versions prior to 1.31.23
Description
A denial-of-service issue exists in the PostScript interpreter of veraPDF-parser. A remote attacker can exhaust validator memory, CPU, or stack by submitting a PDF containing a crafted Type 1 font
/FontFile program. The vulnerability occurs because the parser dispatches tokens through an allow-list that permits unbounded array N allocation and for control operators without zero-increment guards. Specifically, the array operator can be used to request excessive memory allocation, and the for operator can trigger an infinite loop if the increment is zero. Additionally, the toExecute function allows for self-recursive user dictionary lookups without a recursion-depth cap, leading to a StackOverflowError. These issues are handled within the Type1FontProgram and PSOperator classes.Recommendations
Update veraPDF-parser to version 1.30.2 or later.
Update veraPDF-parser to version 1.31.23 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Verapdf-Parser