THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-jrmc-qg6p-94fp (medium) — veraPDF Parser DoS via PostScript CMap Streams

[GHSA] GHSA-jrmc-qg6p-94fp (medium) — veraPDF Parser DoS via PostScript CMap Streams

medgithub_advisoriesPublished 2026-07-29

GHSA-jrmc-qg6p-94fp Severity: medium CVE: CVE-2026-54080

veraPDF Parser DoS via PostScript CMap Streams

## Summary

**Description**

A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allows a remote attacker to exhaust validator memory or CPU by submitting a PDF whose Type 0 font `/Encoding` (or any `/ToUnicode`) is a CMap stream containing attacker-supplied P

Indicators of compromise

CVE-2026-54080cve

Original source: https://github.com/advisories/GHSA-jrmc-qg6p-94fp