CVE-2026-54081

🗓️ 29 Jul 2026 15:18:52Reported by GitHub_MType

VeraPDF parser DoS from crafted Type 1 fonts causing unbounded allocations and recursive lookups; fixed in 1.30.2 and 1.31.23.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-54081	29 Jul 202615:18	–	attackerkb
Circl	CVE-2026-54081	29 Jul 202620:15	–	circl
Cvelist	CVE-2026-54081 veraPDF Parser DoS via PostScript Type 1 Font Programs	29 Jul 202615:18	–	cvelist
EUVD	EUVD-2026-50372	29 Jul 202615:18	–	euvd
Github Security Blog	veraPDF Parser DoS via PostScript Type 1 Font Programs	29 Jul 202615:19	–	github
NVD	CVE-2026-54081	29 Jul 202616:17	–	nvd
OSV	GHSA-7C26-995W-6F47 veraPDF Parser DoS via PostScript Type 1 Font Programs	29 Jul 202615:19	–	osv
Positive Technologies	PT-2026-65824	29 Jul 202600:00	–	ptsecurity

Vulners

Node

verapdf verapdf-parserRange<1.30.2

verapdf verapdf-parserRange1.31.1–1.31.23

[
  {
    "vendor": "veraPDF",
    "product": "veraPDF-parser",
    "versions": [
      {
        "version": "< 1.30.2",
        "status": "affected"
      },
      {
        "version": ">= 1.31.1, < 1.31.23",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/veraPDF/veraPDF-parser/commit/cb3538607a549d63504299be1088c85ae48605f4
github	www.github.com/veraPDF/veraPDF-parser/pull/703
github	www.github.com/veraPDF/veraPDF-parser/security/advisories/GHSA-7c26-995w-6f47
github	www.github.com/veraPDF/veraPDF-parser/commit/73d6ec002b98ce1f3f68640442f8e5d5613c80ce

29 Jul 2026 16:17Current

6Medium risk

Vulners AI Score6

CVSS 46.9

CWE-1325