CVE-2026-54080: CWE-1325: Improperly Controlled Sequential Memory Allocation in veraPDF veraPDF-parser
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 0 font /Encoding or /ToUnicode CMap stream can execute unbounded PostScript array allocation or a zero-increment for loop and exhaust validator memory or CPU. This issue is fixed in versions 1.30.2 and 1.31.23.
AI Analysis
Technical Summary
The veraPDF-parser component of veraPDF is vulnerable to a denial-of-service condition caused by improper control of sequential memory allocation. Specifically, in the CMapParser.java and PSOperator.java source files, a crafted Type 0 font /Encoding or /ToUnicode CMap stream can cause unbounded allocation of PostScript arrays or a zero-increment for loop, leading to exhaustion of validator memory or CPU. This vulnerability affects versions prior to 1.30.2 and 1.31.23 and is fixed in those versions.
Potential Impact
An attacker can cause a denial-of-service by supplying a malicious PDF with a crafted Type 0 font /Encoding or /ToUnicode CMap stream, resulting in excessive memory or CPU consumption by the veraPDF-parser. This can disrupt the normal operation of the PDF validation process but does not indicate code execution or data breach.
Mitigation Recommendations
Upgrade veraPDF-parser to version 1.30.2 or 1.31.23 or later, where this vulnerability is fixed. No other mitigation or workaround is specified. Patch status is confirmed fixed in these versions.
CVE-2026-54080: CWE-1325: Improperly Controlled Sequential Memory Allocation in veraPDF veraPDF-parser
Description
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 0 font /Encoding or /ToUnicode CMap stream can execute unbounded PostScript array allocation or a zero-increment for loop and exhaust validator memory or CPU. This issue is fixed in versions 1.30.2 and 1.31.23.
CVSS v4.0
Score 6.9medium
Affected software
veraPDF
veraPDF-parser
pkg:maven/org.verapdf/veraPDF-parserRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The veraPDF-parser component of veraPDF is vulnerable to a denial-of-service condition caused by improper control of sequential memory allocation. Specifically, in the CMapParser.java and PSOperator.java source files, a crafted Type 0 font /Encoding or /ToUnicode CMap stream can cause unbounded allocation of PostScript arrays or a zero-increment for loop, leading to exhaustion of validator memory or CPU. This vulnerability affects versions prior to 1.30.2 and 1.31.23 and is fixed in those versions.
Potential Impact
An attacker can cause a denial-of-service by supplying a malicious PDF with a crafted Type 0 font /Encoding or /ToUnicode CMap stream, resulting in excessive memory or CPU consumption by the veraPDF-parser. This can disrupt the normal operation of the PDF validation process but does not indicate code execution or data breach.
Mitigation Recommendations
Upgrade veraPDF-parser to version 1.30.2 or 1.31.23 or later, where this vulnerability is fixed. No other mitigation or workaround is specified. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-11T18:44:47.760Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a6a1e549c2644c7f8b2d2f0
Added to database: 07/29/2026, 15:37:56 UTC
Last enriched: 07/29/2026, 15:53:03 UTC
Last updated: 09/12/2026, 15:30:12 UTC
Views: 82
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.