CVE-2026-54081
- Source
- https://cve.org/CVERecord?id=CVE-2026-54081
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-54081.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-54081
- Aliases
- Published
- 2026-07-29T15:18:52Z
- Modified
- 2026-10-06T08:21:16Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- veraPDF Parser DoS via PostScript Type 1 Font Programs
- Details
-
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 1 font /FontDescriptor /FontFile program can execute unbounded PostScript array allocation, a zero-increment for loop, or self-recursive toExecute user dictionary lookups and exhaust validator memory, CPU, or stack. This issue is fixed in versions 1.30.2 and 1.31.23.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1325" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54081.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54081.json
- https://github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-7c26-995w-6f47
- https://nvd.nist.gov/vuln/detail/CVE-2026-54081
- https://github.com/veraPDF/veraPDF-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce
- https://github.com/veraPDF/veraPDF-parser/commit/cb3538607a549d63504299be1088c85ae48605f4
- https://github.com/veraPDF/veraPDF-parser/pull/703
Affected packages
Git / github.com/verapdf/verapdf-parser
Affected ranges
- Type
- GIT
- Repo
- https://github.com/verapdf/verapdf-parser
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.30.2" }, { "introduced": "1.31.1" }, { "fixed": "1.31.23" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
d0.*
d0.1.1
d0.1.10
d0.1.100
d0.1.101
d0.1.102
d0.1.103
d0.1.104
d0.1.105
d0.1.106
d0.1.107
d0.1.108
d0.1.109
d0.1.11
d0.1.110
d0.1.12
d0.1.13
d0.1.14
d0.1.15
d0.1.16
d0.1.17
d0.1.18
d0.1.19
d0.1.2
d0.1.20
d0.1.21
d0.1.22
d0.1.23
d0.1.24
d0.1.25
d0.1.26
d0.1.27
d0.1.28
d0.1.29
d0.1.3
d0.1.30
d0.1.31
d0.1.32
d0.1.33
d0.1.34
d0.1.35
d0.1.36
d0.1.37
d0.1.38
d0.1.39
d0.1.4
d0.1.40
d0.1.41
d0.1.42
d0.1.43
d0.1.44
d0.1.45
d0.1.46
d0.1.47
d0.1.48
d0.1.49
d0.1.5
d0.1.50
d0.1.51
d0.1.52
d0.1.53
d0.1.54
d0.1.55
d0.1.56
d0.1.57
d0.1.58
d0.1.59
d0.1.6
d0.1.60
d0.1.61
d0.1.62
d0.1.63
d0.1.64
d0.1.65
d0.1.66
d0.1.67
d0.1.68
d0.1.69
d0.1.7
d0.1.70
d0.1.71
d0.1.72
d0.1.73
d0.1.74
d0.1.75
d0.1.76
d0.1.77
d0.1.78
d0.1.79
d0.1.8
d0.1.80
d0.1.81
d0.1.82
d0.1.83
d0.1.84
d0.1.85
d0.1.86
d0.1.87
d0.1.88
d0.1.89
d0.1.9
d0.1.90
d0.1.91
d0.1.92
d0.1.93
d0.1.94
d0.1.95
d0.1.96
d0.1.97
d0.1.98
d0.1.99
d0.3.1
d0.3.10
d0.3.11
d0.3.12
d0.3.13
d0.3.14
d0.3.15
d0.3.16
d0.3.17
d0.3.18
d0.3.19
d0.3.2
d0.3.20
d0.3.21
d0.3.22
d0.3.23
d0.3.24
d0.3.25
d0.3.3
d0.3.4
d0.3.5
d0.3.6
d0.3.7
d0.3.8
d0.3.9
d0.5.1
d0.5.2
d0.5.3
d0.5.4
d0.5.5
d0.5.6
d1.*
d1.1.1
d1.1.11
d1.1.12
d1.1.13
d1.1.2
d1.1.3
d1.1.4
d1.1.5
d1.1.6
d1.1.9
d1.11.10
d1.11.11
d1.11.12
d1.11.13
d1.11.14
d1.11.15
d1.11.16
d1.11.17
d1.11.18
d1.11.3
d1.11.4
d1.11.5
d1.11.6
d1.11.7
d1.11.8
d1.11.9
d1.13.1
d1.13.10
d1.13.11
d1.13.12
d1.13.13
d1.13.14
d1.13.15
d1.13.2
d1.13.3
d1.13.4
d1.13.5
d1.13.6
d1.13.7
d1.13.8
d1.13.9
d1.3.1
d1.3.10
d1.3.2
d1.3.3
d1.3.4
d1.3.5
d1.3.6
d1.3.7
d1.3.8
d1.3.9
d1.5.1
d1.5.10
d1.5.11
d1.5.12
d1.5.13
d1.5.14
d1.5.15
d1.5.16
d1.5.17
d1.5.18
d1.5.19
d1.5.2
d1.5.20
d1.5.3
d1.5.4
d1.5.5
d1.5.6
d1.5.7
d1.5.9
d1.7.1
d1.7.10
d1.7.11
d1.7.12
d1.7.13
d1.7.14
d1.7.15
d1.7.16
d1.7.17
d1.7.18
d1.7.19
d1.7.2
d1.7.20
d1.7.21
d1.7.22
d1.7.23
d1.7.24
d1.7.25
d1.7.26
d1.7.27
d1.7.28
d1.7.29
d1.7.3
d1.7.30
d1.7.31
d1.7.32
d1.7.33
d1.7.34
d1.7.35
d1.7.36
d1.7.37
d1.7.38
d1.7.39
d1.7.4
d1.7.40
d1.7.41
d1.7.42
d1.7.43
d1.7.44
d1.7.45
d1.7.46
d1.7.5
d1.7.6
d1.7.7
d1.7.8
d1.7.9
d1.9.1
d1.9.10
d1.9.11
d1.9.12
d1.9.13
d1.9.14
d1.9.15
d1.9.16
d1.9.17
d1.9.18
d1.9.19
d1.9.2
d1.9.20
d1.9.21
d1.9.22
d1.9.23
d1.9.24
d1.9.25
d1.9.26
d1.9.27
d1.9.28
d1.9.29
d1.9.3
d1.9.30
d1.9.31
d1.9.32
d1.9.33
d1.9.34
d1.9.35
d1.9.36
d1.9.37
d1.9.38
d1.9.4
d1.9.5
d1.9.6
d1.9.7
d1.9.8
d1.9.9
v1.*
v1.13.16
v1.15.10
v1.15.11
v1.15.12
v1.15.13
v1.15.14
v1.15.15
v1.15.16
v1.15.17
v1.15.19
v1.15.2
v1.15.20
v1.15.21
v1.15.3
v1.15.5
v1.15.6
v1.15.7
v1.15.8
v1.15.9
v1.17.1
v1.17.10
v1.17.11
v1.17.12
v1.17.13
v1.17.14
v1.17.15
v1.17.16
v1.17.17
v1.17.18
v1.17.2
v1.17.20
v1.17.21
v1.17.22
v1.17.23
v1.17.24
v1.17.25
v1.17.26
v1.17.3
v1.17.4
v1.17.5
v1.17.7
v1.17.8
v1.17.9
v1.19.1
v1.19.10
v1.19.11
v1.19.12
v1.19.13
v1.19.14
v1.19.15
v1.19.16
v1.19.17
v1.19.18
v1.19.19
v1.19.2
v1.19.20
v1.19.21
v1.19.22
v1.19.23
v1.19.24
v1.19.25
v1.19.26
v1.19.27
v1.19.28
v1.19.29
v1.19.3
v1.19.30
v1.19.31
v1.19.32
v1.19.33
v1.19.34
v1.19.35
v1.19.36
v1.19.37
v1.19.38
v1.19.39
v1.19.4
v1.19.40
v1.19.41
v1.19.42
v1.19.43
v1.19.44
v1.19.45
v1.19.46
v1.19.47
v1.19.48
v1.19.49
v1.19.5
v1.19.50
v1.19.6
v1.19.7
v1.19.8
v1.19.9
v1.21.1
v1.21.10
v1.21.11
v1.21.12
v1.21.13
v1.21.14
v1.21.15
v1.21.16
v1.21.17
v1.21.18
v1.21.19
v1.21.2
v1.21.20
v1.21.21
v1.21.22
v1.21.23
v1.21.24
v1.21.25
v1.21.26
v1.21.27
v1.21.28
v1.21.29
v1.21.3
v1.21.30
v1.21.31
v1.21.32
v1.21.33
v1.21.34
v1.21.35
v1.21.36
v1.21.37
v1.21.38
v1.21.39
v1.21.4
v1.21.5
v1.21.6
v1.21.7
v1.21.8
v1.21.9
v1.23.1
v1.23.10
v1.23.11
v1.23.12
v1.23.13
v1.23.14
v1.23.15
v1.23.16
v1.23.17
v1.23.18
v1.23.19
v1.23.2
v1.23.20
v1.23.21
v1.23.22
v1.23.23
v1.23.24
v1.23.25
v1.23.29
v1.23.3
v1.23.30
v1.23.4
v1.23.5
v1.23.6
v1.23.7
v1.23.8
v1.23.9
v1.25.1
v1.25.10
v1.25.11
v1.25.12
v1.25.13
v1.25.14
v1.25.15
v1.25.16
v1.25.17
v1.25.2
v1.25.22
v1.25.23
v1.25.24
v1.25.25
v1.25.26
v1.25.27
v1.25.28
v1.25.29
v1.25.3
v1.25.30
v1.25.31
v1.25.32
v1.25.33
v1.25.34
v1.25.35
v1.25.36
v1.25.37
v1.25.38
v1.25.39
v1.25.4
v1.25.40
v1.25.41
v1.25.42
v1.25.43
v1.25.44
v1.25.45
v1.25.46
v1.25.47
v1.25.48
v1.25.49
v1.25.5
v1.25.50
v1.25.51
v1.25.52
v1.25.53
v1.25.54
v1.25.55
v1.25.56
v1.25.57
v1.25.58
v1.25.59
v1.25.6
v1.25.60
v1.25.61
v1.25.62
v1.25.63
v1.25.64
v1.25.65
v1.25.66
v1.25.67
v1.25.68
v1.25.69
v1.25.7
v1.25.70
v1.25.8
v1.25.9
v1.27.1
v1.27.10
v1.27.11
v1.27.12
v1.27.13
v1.27.14
v1.27.15
v1.27.16
v1.27.17
v1.27.18
v1.27.19
v1.27.2
v1.27.20
v1.27.21
v1.27.22
v1.27.23
v1.27.24
v1.27.25
v1.27.26
v1.27.27
v1.27.28
v1.27.3
v1.27.4
v1.27.5
v1.27.6
v1.27.7
v1.27.8
v1.27.9
v1.29.1
v1.29.11
v1.29.12
v1.29.13
v1.29.14
v1.29.15
v1.29.16
v1.29.17
v1.29.18
v1.29.19
v1.29.2
v1.29.20
v1.29.21
v1.29.22
v1.29.23
v1.29.24
v1.29.25
v1.29.26
v1.29.28
v1.29.29
v1.29.3
v1.29.30
v1.29.31
v1.29.32
v1.29.33
v1.29.34
v1.29.35
v1.29.36
v1.29.37
v1.29.38
v1.29.39
v1.29.4
v1.29.40
v1.29.41
v1.29.42
v1.29.43
v1.29.44
v1.29.45
v1.29.46
v1.29.47
v1.29.48
v1.29.49
v1.29.5
v1.29.50
v1.29.51
v1.29.52
v1.29.53
v1.29.54
v1.29.55
v1.29.56
v1.29.57
v1.29.58
v1.29.59
v1.29.60
v1.29.61
v1.29.63
v1.29.64
v1.29.65
v1.29.7
v1.29.8
v1.29.9
v1.30.0-RC1
v1.30.1
v1.31.1
v1.31.10
v1.31.11
v1.31.12
v1.31.13
v1.31.14
v1.31.15
v1.31.16
v1.31.17
v1.31.18
v1.31.19
v1.31.2
v1.31.20
v1.31.21
v1.31.22
v1.31.3
v1.31.4
v1.31.5
v1.31.6
v1.31.7
v1.31.8
v1.31.9
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-54081.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"11662608000563665930094645397537541308",
"233666436224892212599289652479722449232",
"67090118333499712123056622177408402398",
"317182243455189530300451587041081849042",
"134971465520338359600687738481693986168",
"11231560877388260466345664056509401491",
"107486923715938170114830940343846516535"
],
"threshold": 0.9
},
"id": "CVE-2026-54081-1add2402",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/40b7f7ca84d340adfe14d4b17860090026a4e28a",
"target": {
"file": "src/main/java/org/verapdf/pd/structure/PDStructElem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"98582382101691779970219304386364035642",
"109269905159466747527695019208457467192",
"211940795188805823981210567757771592223",
"241538989968996493234738751290801845489",
"315053639942991693570612762733225541817",
"69991802558655909290640384633051535471",
"171755389779443103379274546623315267163",
"213477186619263266414829449446240857856",
"231357701115029490726500182619830596583",
"209832821949906471977498793196232693724",
"189284266728943046856568573194671888536",
"84503798001106694292102408300906399137",
"145721904896843170350850010059378038217",
"318982195844435527712399723480308844197",
"40015352427965684245359638167201530980",
"271247889789006023757529721538236331602"
],
"threshold": 0.9
},
"id": "CVE-2026-54081-1e5cfe7a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce",
"target": {
"file": "src/main/java/org/verapdf/parser/postscript/PSOperator.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "138368612310795239651195982575470856490",
"length": 355
},
"id": "CVE-2026-54081-201a9c32",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce",
"target": {
"file": "src/main/java/org/verapdf/parser/postscript/PSOperator.java",
"function": "array"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "106291324911844495358109419480292264798",
"length": 594
},
"id": "CVE-2026-54081-3ae6d75d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/cb3538607a549d63504299be1088c85ae48605f4",
"target": {
"file": "src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java",
"function": "toExecute"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "225237957730290501120461792391587903992",
"length": 975
},
"id": "CVE-2026-54081-3dee8885",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/cb3538607a549d63504299be1088c85ae48605f4",
"target": {
"file": "src/main/java/org/verapdf/parser/postscript/PSOperator.java",
"function": "opFor"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"195663887680346415641287389599198748222",
"98582382101691779970219304386364035642",
"4723101074593947339276289873567958974",
"211184379142048141848578264245395415861",
"17445017550002041271361187646541741721",
"315053639942991693570612762733225541817",
"70864541680206884972977676964453719027",
"96508254400117486481043679256240905539",
"169017283779746849247969191868936462824",
"36374582123308092792725131352223989920",
"70524356589795789819845373376315473107",
"173876409862980342114908737205554977163",
"47231648316793685733348524677046479100",
"143405628567288826217495042510840052398",
"150173422338846385856498398678638199854",
"20897565789501965759668378742715969106",
"315642028418500859683064837986047626534",
"170568127360450433834534205163763299818",
"243870983495893106225638643854618035038",
"33513857935175298212008861511439970122",
"237340791017891662355883221574913512260",
"164092836923313631299215967761636819012",
"286271228849979579546653027746493411572",
"42647575091407801268208503586897215238",
"122114200096781065358853986565474175181"
],
"threshold": 0.9
},
"id": "CVE-2026-54081-40c837bc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/cb3538607a549d63504299be1088c85ae48605f4",
"target": {
"file": "src/main/java/org/verapdf/parser/postscript/PSOperator.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "127655024055736712591585626157975737788",
"length": 75
},
"id": "CVE-2026-54081-57c3c5c6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/40b7f7ca84d340adfe14d4b17860090026a4e28a",
"target": {
"file": "src/main/java/org/verapdf/pd/structure/PDStructElem.java",
"function": "getRoleMapToSameNamespaceTag"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "53206195035868704330612518154225430468",
"length": 457
},
"id": "CVE-2026-54081-7a017f9b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce",
"target": {
"file": "src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java",
"function": "toExecute"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"322200364880910242191979278161730524722",
"56504495342932432920570255284250373501",
"61719821691631345568698951496376735962",
"25156651414026009096811312617000098433",
"84473205503382220219712581577932946709",
"164806415834738888540087096458864398880",
"309655769115127047084668998481769063726",
"284006495195835120679273706596445602161",
"330229975012471396759686654726054036116",
"100477234807700792245377895484002008003",
"275439925619848523273333087160570500652",
"163144269949054340699288371208243862637",
"108300451323649005682975499779574503803",
"123518778952739622463078207797760609741",
"27640575777691646914966080215267910549",
"1287300797207686399623137934553277582",
"107117363802789675645509824957850306938",
"52409329011909513907789065898469426919",
"140476848774109504832327672737384338735",
"200147260191198607227304827771566095292",
"132672236776706564214595485099020481786",
"12080992909226655485531553730513847415",
"153293682294722364801733624546351818021",
"157120991707677128166346764266638855642"
],
"threshold": 0.9
},
"id": "CVE-2026-54081-9fb78e56",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/40b7f7ca84d340adfe14d4b17860090026a4e28a",
"target": {
"file": "src/main/java/org/verapdf/tools/TaggedPDFHelper.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "113732939501282541664334001391414002605",
"length": 646
},
"id": "CVE-2026-54081-a2e82928",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce",
"target": {
"file": "src/main/java/org/verapdf/parser/postscript/PSOperator.java",
"function": "opFor"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "197283452107269494160603258557775642516",
"length": 467
},
"id": "CVE-2026-54081-cc714679",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/cb3538607a549d63504299be1088c85ae48605f4",
"target": {
"file": "src/main/java/org/verapdf/parser/postscript/PSOperator.java",
"function": "array"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"258056402451502277344423023738487378644",
"189794635922297989616013890277936422387",
"227519332565316059146101167057411335616",
"241389255677955291603878764645444751394",
"105256116746216956910966186711002460881",
"82347759967284759484934361715933606265",
"221485460218279917751478151605803238901",
"225427477055331915214724428737030861459",
"75293331357164352931261925774036334605",
"217011085066559111463152282400411888514",
"212477862283477350807757555265802326441",
"6181850362968482892765830677366487078",
"305896252554872512930445545085065982985",
"265493604495749979852018011142476093669"
],
"threshold": 0.9
},
"id": "CVE-2026-54081-cfc71742",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce",
"target": {
"file": "src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "114886452607207240779841805219143580951",
"length": 80
},
"id": "CVE-2026-54081-e39393e2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/40b7f7ca84d340adfe14d4b17860090026a4e28a",
"target": {
"file": "src/main/java/org/verapdf/pd/structure/PDStructElem.java",
"function": "getDefaultStructureType"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"101038545618544060062841208076234883756",
"288952574762839516594456466502034364673",
"170085215644684979422881713056298185346",
"247922817205224639618335388704637875565"
],
"threshold": 0.9
},
"id": "CVE-2026-54081-fef28b7b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/verapdf/verapdf-parser/commit/cb3538607a549d63504299be1088c85ae48605f4",
"target": {
"file": "src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java"
}
}
]
vanir_signatures_modified
"2026-10-06T08:21:16Z"