cve.bz

CVE-2024-28109

8.1 highEPSS 1.0%

High (8.1). EPSS 1.0% chance of exploitation in the next 30 days. Fixed in org.verapdf:core 1.24.2.

veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.

Severity

CVSS 3.1

8.1 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE
CWE-91
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-qxqf-2mfx-x8jwMavenorg.verapdf:core<1.24.21.24.2
GHSA-qxqf-2mfx-x8jwMavenorg.verapdf:core-jakarta<1.24.21.24.2
GHSA-qxqf-2mfx-x8jwMavenorg.verapdf:core-arlington<1.25.1271.25.127
GHSA-qxqf-2mfx-x8jwMavenorg.verapdf:verapdf-library-arlington<1.25.1271.25.127
GHSA-qxqf-2mfx-x8jwMavenorg.verapdf:verapdf-library<1.24.21.24.2
GHSA-qxqf-2mfx-x8jwMavenorg.verapdf:verapdf-library-jakarta<1.24.21.24.2
GHSA-qxqf-2mfx-x8jwMavenorg.verapdf:library-arlington<1.25.1271.25.127
GHSA-qxqf-2mfx-x8jwMavenorg.verapdf:library<1.24.21.24.2
GHSA-qxqf-2mfx-x8jwMavenorg.verapdf:library-jakarta<1.24.21.24.2

References

Check your stackJSON