CVE-2026-54081

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54081

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54081.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54081

Aliases

GHSA-7c26-995w-6f47

Published

2026-07-29T15:18:52.076Z

Modified

2026-07-31T03:49:06.126235488Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

veraPDF Parser DoS via PostScript Type 1 Font Programs

Details

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 1 font /FontDescriptor /FontFile program can execute unbounded PostScript array allocation, a zero-increment for loop, or self-recursive toExecute user dictionary lookups and exhaust validator memory, CPU, or stack. This issue is fixed in versions 1.30.2 and 1.31.23.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54081.json",
    "cwe_ids": [
        "CWE-1325"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/verapdf/verapdf-parser

Affected ranges

Type

GIT

Repo

https://github.com/verapdf/verapdf-parser

Events

Introduced

d2ef2a8ba92dacfd3a4e05c6de6fa3e7cbc60f9e

Fixed

40b7f7ca84d340adfe14d4b17860090026a4e28a

Fixed

cb3538607a549d63504299be1088c85ae48605f4

Fixed

73d6ec002b98ce1f3f68640442f8e5d5613c80ce

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.30.2"
        },
        {
            "introduced": "1.31.1"
        },
        {
            "fixed": "1.31.23"
        }
    ]
}

Affected versions

d0.*

d0.1.1

d0.1.10

d0.1.100

d0.1.101

d0.1.102

d0.1.103

d0.1.104

d0.1.105

d0.1.106

d0.1.107

d0.1.108

d0.1.109

d0.1.11

d0.1.110

d0.1.12

d0.1.13

d0.1.14

d0.1.15

d0.1.16

d0.1.17

d0.1.18

d0.1.19

d0.1.2

d0.1.20

d0.1.21

d0.1.22

d0.1.23

d0.1.24

d0.1.25

d0.1.26

d0.1.27

d0.1.28

d0.1.29

d0.1.3

d0.1.30

d0.1.31

d0.1.32

d0.1.33

d0.1.34

d0.1.35

d0.1.36

d0.1.37

d0.1.38

d0.1.39

d0.1.4

d0.1.40

d0.1.41

d0.1.42

d0.1.43

d0.1.44

d0.1.45

d0.1.46

d0.1.47

d0.1.48

d0.1.49

d0.1.5

d0.1.50

d0.1.51

d0.1.52

d0.1.53

d0.1.54

d0.1.55

d0.1.56

d0.1.57

d0.1.58

d0.1.59

d0.1.6

d0.1.60

d0.1.61

d0.1.62

d0.1.63

d0.1.64

d0.1.65

d0.1.66

d0.1.67

d0.1.68

d0.1.69

d0.1.7

d0.1.70

d0.1.71

d0.1.72

d0.1.73

d0.1.74

d0.1.75

d0.1.76

d0.1.77

d0.1.78

d0.1.79

d0.1.8

d0.1.80

d0.1.81

d0.1.82

d0.1.83

d0.1.84

d0.1.85

d0.1.86

d0.1.87

d0.1.88

d0.1.89

d0.1.9

d0.1.90

d0.1.91

d0.1.92

d0.1.93

d0.1.94

d0.1.95

d0.1.96

d0.1.97

d0.1.98

d0.1.99

d0.3.1

d0.3.10

d0.3.11

d0.3.12

d0.3.13

d0.3.14

d0.3.15

d0.3.16

d0.3.17

d0.3.18

d0.3.19

d0.3.2

d0.3.20

d0.3.21

d0.3.22

d0.3.23

d0.3.24

d0.3.25

d0.3.3

d0.3.4

d0.3.5

d0.3.6

d0.3.7

d0.3.8

d0.3.9

d0.5.1

d0.5.2

d0.5.3

d0.5.4

d0.5.5

d0.5.6

d1.*

d1.1.1

d1.1.11

d1.1.12

d1.1.13

d1.1.2

d1.1.3

d1.1.4

d1.1.5

d1.1.6

d1.1.9

d1.11.10

d1.11.11

d1.11.12

d1.11.13

d1.11.14

d1.11.15

d1.11.16

d1.11.17

d1.11.18

d1.11.3

d1.11.4

d1.11.5

d1.11.6

d1.11.7

d1.11.8

d1.11.9

d1.13.1

d1.13.10

d1.13.11

d1.13.12

d1.13.13

d1.13.14

d1.13.15

d1.13.2

d1.13.3

d1.13.4

d1.13.5

d1.13.6

d1.13.7

d1.13.8

d1.13.9

d1.3.1

d1.3.10

d1.3.2

d1.3.3

d1.3.4

d1.3.5

d1.3.6

d1.3.7

d1.3.8

d1.3.9

d1.5.1

d1.5.10

d1.5.11

d1.5.12

d1.5.13

d1.5.14

d1.5.15

d1.5.16

d1.5.17

d1.5.18

d1.5.19

d1.5.2

d1.5.20

d1.5.3

d1.5.4

d1.5.5

d1.5.6

d1.5.7

d1.5.9

d1.7.1

d1.7.10

d1.7.11

d1.7.12

d1.7.13

d1.7.14

d1.7.15

d1.7.16

d1.7.17

d1.7.18

d1.7.19

d1.7.2

d1.7.20

d1.7.21

d1.7.22

d1.7.23

d1.7.24

d1.7.25

d1.7.26

d1.7.27

d1.7.28

d1.7.29

d1.7.3

d1.7.30

d1.7.31

d1.7.32

d1.7.33

d1.7.34

d1.7.35

d1.7.36

d1.7.37

d1.7.38

d1.7.39

d1.7.4

d1.7.40

d1.7.41

d1.7.42

d1.7.43

d1.7.44

d1.7.45

d1.7.46

d1.7.5

d1.7.6

d1.7.7

d1.7.8

d1.7.9

d1.9.1

d1.9.10

d1.9.11

d1.9.12

d1.9.13

d1.9.14

d1.9.15

d1.9.16

d1.9.17

d1.9.18

d1.9.19

d1.9.2

d1.9.20

d1.9.21

d1.9.22

d1.9.23

d1.9.24

d1.9.25

d1.9.26

d1.9.27

d1.9.28

d1.9.29

d1.9.3

d1.9.30

d1.9.31

d1.9.32

d1.9.33

d1.9.34

d1.9.35

d1.9.36

d1.9.37

d1.9.38

d1.9.4

d1.9.5

d1.9.6

d1.9.7

d1.9.8

d1.9.9

v1.*

v1.13.16

v1.15.10

v1.15.11

v1.15.12

v1.15.13

v1.15.14

v1.15.15

v1.15.16

v1.15.17

v1.15.19

v1.15.2

v1.15.20

v1.15.21

v1.15.3

v1.15.5

v1.15.6

v1.15.7

v1.15.8

v1.15.9

v1.17.1

v1.17.10

v1.17.11

v1.17.12

v1.17.13

v1.17.14

v1.17.15

v1.17.16

v1.17.17

v1.17.18

v1.17.2

v1.17.20

v1.17.21

v1.17.22

v1.17.23

v1.17.24

v1.17.25

v1.17.26

v1.17.3

v1.17.4

v1.17.5

v1.17.7

v1.17.8

v1.17.9

v1.19.1

v1.19.10

v1.19.11

v1.19.12

v1.19.13

v1.19.14

v1.19.15

v1.19.16

v1.19.17

v1.19.18

v1.19.19

v1.19.2

v1.19.20

v1.19.21

v1.19.22

v1.19.23

v1.19.24

v1.19.25

v1.19.26

v1.19.27

v1.19.28

v1.19.29

v1.19.3

v1.19.30

v1.19.31

v1.19.32

v1.19.33

v1.19.34

v1.19.35

v1.19.36

v1.19.37

v1.19.38

v1.19.39

v1.19.4

v1.19.40

v1.19.41

v1.19.42

v1.19.43

v1.19.44

v1.19.45

v1.19.46

v1.19.47

v1.19.48

v1.19.49

v1.19.5

v1.19.50

v1.19.6

v1.19.7

v1.19.8

v1.19.9

v1.21.1

v1.21.10

v1.21.11

v1.21.12

v1.21.13

v1.21.14

v1.21.15

v1.21.16

v1.21.17

v1.21.18

v1.21.19

v1.21.2

v1.21.20

v1.21.21

v1.21.22

v1.21.23

v1.21.24

v1.21.25

v1.21.26

v1.21.27

v1.21.28

v1.21.29

v1.21.3

v1.21.30

v1.21.31

v1.21.32

v1.21.33

v1.21.34

v1.21.35

v1.21.36

v1.21.37

v1.21.38

v1.21.39

v1.21.4

v1.21.5

v1.21.6

v1.21.7

v1.21.8

v1.21.9

v1.23.1

v1.23.10

v1.23.11

v1.23.12

v1.23.13

v1.23.14

v1.23.15

v1.23.16

v1.23.17

v1.23.18

v1.23.19

v1.23.2

v1.23.20

v1.23.21

v1.23.22

v1.23.23

v1.23.24

v1.23.25

v1.23.29

v1.23.3

v1.23.30

v1.23.4

v1.23.5

v1.23.6

v1.23.7

v1.23.8

v1.23.9

v1.25.1

v1.25.10

v1.25.11

v1.25.12

v1.25.13

v1.25.14

v1.25.15

v1.25.16

v1.25.17

v1.25.2

v1.25.22

v1.25.23

v1.25.24

v1.25.25

v1.25.26

v1.25.27

v1.25.28

v1.25.29

v1.25.3

v1.25.30

v1.25.31

v1.25.32

v1.25.33

v1.25.34

v1.25.35

v1.25.36

v1.25.37

v1.25.38

v1.25.39

v1.25.4

v1.25.40

v1.25.41

v1.25.42

v1.25.43

v1.25.44

v1.25.45

v1.25.46

v1.25.47

v1.25.48

v1.25.49

v1.25.5

v1.25.50

v1.25.51

v1.25.52

v1.25.53

v1.25.54

v1.25.55

v1.25.56

v1.25.57

v1.25.58

v1.25.59

v1.25.6

v1.25.60

v1.25.61

v1.25.62

v1.25.63

v1.25.64

v1.25.65

v1.25.66

v1.25.67

v1.25.68

v1.25.69

v1.25.7

v1.25.70

v1.25.8

v1.25.9

v1.27.1

v1.27.10

v1.27.11

v1.27.12

v1.27.13

v1.27.14

v1.27.15

v1.27.16

v1.27.17

v1.27.18

v1.27.19

v1.27.2

v1.27.20

v1.27.21

v1.27.22

v1.27.23

v1.27.24

v1.27.25

v1.27.26

v1.27.27

v1.27.28

v1.27.3

v1.27.4

v1.27.5

v1.27.6

v1.27.7

v1.27.8

v1.27.9

v1.29.1

v1.29.11

v1.29.12

v1.29.13

v1.29.14

v1.29.15

v1.29.16

v1.29.17

v1.29.18

v1.29.19

v1.29.2

v1.29.20

v1.29.21

v1.29.22

v1.29.23

v1.29.24

v1.29.25

v1.29.26

v1.29.28

v1.29.29

v1.29.3

v1.29.30

v1.29.31

v1.29.32

v1.29.33

v1.29.34

v1.29.35

v1.29.36

v1.29.37

v1.29.38

v1.29.39

v1.29.4

v1.29.40

v1.29.41

v1.29.42

v1.29.43

v1.29.44

v1.29.45

v1.29.46

v1.29.47

v1.29.48

v1.29.49

v1.29.5

v1.29.50

v1.29.51

v1.29.52

v1.29.53

v1.29.54

v1.29.55

v1.29.56

v1.29.57

v1.29.58

v1.29.59

v1.29.60

v1.29.61

v1.29.63

v1.29.64

v1.29.65

v1.29.7

v1.29.8

v1.29.9

v1.30.0-RC1

v1.30.1

v1.31.1

v1.31.10

v1.31.11

v1.31.12

v1.31.13

v1.31.14

v1.31.15

v1.31.16

v1.31.17

v1.31.18

v1.31.19

v1.31.2

v1.31.20

v1.31.21

v1.31.22

v1.31.3

v1.31.4

v1.31.5

v1.31.6

v1.31.7

v1.31.8

v1.31.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54081.json"