Skip to main content

veraPDF-parser CVE-2026-54080

| EUVDEUVD-2026-50371 MEDIUM
Improperly Controlled Sequential Memory Allocation (CWE-1325)
2026-07-29 GitHub_M GHSA-jrmc-qg6p-94fp
Java Information Disclosure Verapdf Parser
6.9
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable PDF processing with no auth needed; uncaught OutOfMemoryError terminates the JVM process entirely, warranting High rather than the provided Low availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 29, 2026 - 16:02 EUVD
Source Code Evidence Fetched
Jul 29, 2026 - 15:51 vuln.today
Analysis Generated
Jul 29, 2026 - 15:51 vuln.today

DescriptionCVE.org

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/cmap/CMapParser.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java, where a crafted Type 0 font /Encoding or /ToUnicode CMap stream can execute unbounded PostScript array allocation or a zero-increment for loop and exhaust validator memory or CPU. This issue is fixed in versions 1.30.2 and 1.31.23.

AnalysisAI

Memory and CPU exhaustion in veraPDF-parser's embedded PostScript interpreter allows remote unauthenticated attackers to crash the PDF validator by submitting a single crafted PDF. All 1.30.x releases prior to 1.30.2 and all 1.31.x releases prior to 1.31.23 of the Maven artifact org.verapdf:parser are affected. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit crafted PDF with malicious CMap stream to veraPDF endpoint
Delivery
CMapParser processes Type 0 font /Encoding token
Exploit
Unrecognized PostScript token falls through to PSOperator
Execution
array or zero-increment for operator executes without bounds check
Persist
JVM OutOfMemoryError or CPU spin triggered
Impact
Validation worker process terminates
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target must be running an unpatched version of org.verapdf:parser (<=1.30.1 or >=1.31.1 and <=1.31.22) and must process a PDF that is supplied by or influenced by the attacker - such as a document intake API, a compliance pipeline processing emailed attachments, or a CI/CD PDF validation step accepting external files. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity remote exploitation requiring no user interaction, consistent with any network-accessible document processing endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits a minimally crafted PDF over HTTP to a veraPDF-backed document intake or compliance validation API, containing a Type 0 font whose /Encoding CMap stream carries the bare PostScript payload `2147483647 array`. When veraPDF processes the font, CMapParser dispatches the token to PSOperator, which attempts to allocate a 16 GB ArrayList, triggering an uncaught OutOfMemoryError that terminates the validation worker. …
Remediation Upgrade the Maven artifact org.verapdf:parser to version 1.30.2 (for consumers on the 1.30.x branch) or 1.31.23 (for consumers on the 1.31.x branch), as confirmed by the vendor in the GHSA advisory at https://github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-jrmc-qg6p-94fp. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-1325 – Improperly Controlled Sequential Memory Allocation

View all
CVE-2025-13945 MEDIUM POC
5.5
CVE-2026-3201 MEDIUM POC
4.7
CVE-2024-27796 HIGH
7.8
CVE-2025-2240 HIGH
7.5
CVE-2026-34183 HIGH
7.5
CVE-2021-43174 HIGH
7.5
CVE-2026-13056 HIGH
7.1
CVE-2026-8199 HIGH
7.1

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2024-24919 HIGH POC
8.6

Share

CVE-2026-54080 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy