Search
Find a vulnerability
Search criteria
4 vulnerabilities found for mupdf by artifex
CVE-2026-112036 (GCVE-0-2026-112036)
Vulnerability from cvelistv5 – Published: 2026-10-19 00:45 – Updated: 2026-10-19 16:37
VLAI
EPSS
VEX
Title
Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
Summary
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:46 UTC
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421684 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421684/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112036 | third-party-advisory |
| https://vuldb.com/submit/1008495 | third-party-advisory |
| https://bugs.ghostscript.com/show_bug.cgi?id=709768 | issue-tracking |
| https://bugs.ghostscript.com/attachment.cgi?id=28609 | exploit |
| http://www.ghostscript.com/cgi-bin/findgit.cgi?39… | broken-linkpatch |
| https://artifex.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112036",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:46:32.429837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:37:09.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*"
],
"modules": [
"Signature Locking"
],
"product": "MuPDF",
"vendor": "Artifex",
"versions": [
{
"status": "affected",
"version": "1.28.0"
},
{
"status": "affected",
"version": "1.28.1"
},
{
"status": "affected",
"version": "1.28.2"
},
{
"status": "affected",
"version": "1.28.3"
},
{
"status": "affected",
"version": "1.28.4"
},
{
"status": "affected",
"version": "1.28.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "suyuanwang (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "Double Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T00:45:12.234Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421684 | Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421684"
},
{
"name": "VDB-421684 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421684/cti"
},
{
"name": "CVE-2026-112036 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112036"
},
{
"name": "Submit #1008495 | MuPDF 1.28.5 Double Free",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1008495"
},
{
"tags": [
"issue-tracking"
],
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709768"
},
{
"tags": [
"exploit"
],
"url": "https://bugs.ghostscript.com/attachment.cgi?id=28609"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "http://www.ghostscript.com/cgi-bin/findgit.cgi?3984925b660afb8a781ddf504021e91be1bc671e"
},
{
"tags": [
"product"
],
"url": "https://artifex.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T11:17:55.000Z",
"value": "VulDB entry last update"
}
],
"title": "Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112036",
"datePublished": "2026-10-19T00:45:12.234Z",
"dateReserved": "2026-10-18T09:12:35.046Z",
"dateUpdated": "2026-10-19T16:37:09.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92413 (GCVE-0-2026-92413)
Vulnerability from cvelistv5 – Published: 2026-09-16 17:30 – Updated: 2026-09-18 18:14
VLAI
EPSS
VEX
Title
Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference
Summary
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 18:14 UTC
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/405593 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/405593/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-92413 | third-party-advisory |
| https://vuldb.com/submit/940975 | third-party-advisory |
| https://bugs.ghostscript.com/show_bug.cgi?id=709610 | issue-tracking |
| https://bugs.ghostscript.com/attachment.cgi?id=28434 | exploit |
| https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mup… | patch |
| https://artifex.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92413",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T18:14:08.965941Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T18:14:41.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709610"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*"
],
"modules": [
"PDF Xref Loading"
],
"product": "MuPDF",
"vendor": "Artifex",
"versions": [
{
"status": "affected",
"version": "b6d17493700c621c0e70036980a6ebd06d2202c9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fczhang (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:30:10.298Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-405593 | Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/405593"
},
{
"name": "VDB-405593 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/405593/cti"
},
{
"name": "CVE-2026-92413 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-92413"
},
{
"name": "Submit #940975 | Artifex Software MuPDF mutool commit b6d17493700c621c0e70036980a6ebd06d2202c9 NULL pointer dereference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/940975"
},
{
"tags": [
"issue-tracking"
],
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709610"
},
{
"tags": [
"exploit"
],
"url": "https://bugs.ghostscript.com/attachment.cgi?id=28434"
},
{
"tags": [
"patch"
],
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=3df1e30f9d7b77260e13bd0dbe1928ddeba8386e"
},
{
"tags": [
"product"
],
"url": "https://artifex.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-16T11:38:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-92413",
"datePublished": "2026-09-16T17:30:10.298Z",
"dateReserved": "2026-09-16T09:32:58.686Z",
"dateUpdated": "2026-09-18T18:14:41.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7233 (GCVE-0-2026-7233)
Vulnerability from cvelistv5 – Published: 2026-04-28 06:00 – Updated: 2026-11-01 07:27
VLAI
EPSS
VEX
Title
Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds
Summary
A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-29 15:14 UTC
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/359840 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/359840/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-7233 | third-party-advisory |
| https://vuldb.com/submit/802590 | third-party-advisory |
| https://bugs.ghostscript.com/show_bug.cgi?id=709328 | issue-tracking |
| https://github.com/biniamf/pocs/tree/main/mupdf-c… | exploit |
| https://artifex.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Artifex | MuPDF |
Affected:
1.24.0
Affected: 1.24.1 Affected: 1.24.2 Affected: 1.24.3 Affected: 1.24.4 Affected: 1.24.5 Affected: 1.24.6 Affected: 1.24.7 Affected: 1.24.8 Affected: 1.24.9 Affected: 1.24.10 Affected: 1.24.11 Affected: 1.25.0 Affected: 1.25.1 Affected: 1.25.2 Affected: 1.25.3 Affected: 1.25.4 Affected: 1.25.5 Affected: 1.25.6 Affected: 1.26.0 Affected: 1.26.1 Affected: 1.26.2 Affected: 1.26.3 Affected: 1.26.4 Affected: 1.26.5 Affected: 1.26.6 Affected: 1.26.7 Affected: 1.26.8 Affected: 1.26.9 Affected: 1.26.10 Affected: 1.26.11 Affected: 1.26.12 Affected: 1.27.0 Affected: 1.27.1 Affected: 1.27.2 Affected: 1.28.0 cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7233",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-29T15:14:06.670638Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-05T20:23:51.185Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/802590"
},
{
"tags": [
"exploit"
],
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709328"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*"
],
"modules": [
"CFF Index Handler"
],
"product": "MuPDF",
"vendor": "Artifex",
"versions": [
{
"status": "affected",
"version": "1.24.0"
},
{
"status": "affected",
"version": "1.24.1"
},
{
"status": "affected",
"version": "1.24.2"
},
{
"status": "affected",
"version": "1.24.3"
},
{
"status": "affected",
"version": "1.24.4"
},
{
"status": "affected",
"version": "1.24.5"
},
{
"status": "affected",
"version": "1.24.6"
},
{
"status": "affected",
"version": "1.24.7"
},
{
"status": "affected",
"version": "1.24.8"
},
{
"status": "affected",
"version": "1.24.9"
},
{
"status": "affected",
"version": "1.24.10"
},
{
"status": "affected",
"version": "1.24.11"
},
{
"status": "affected",
"version": "1.25.0"
},
{
"status": "affected",
"version": "1.25.1"
},
{
"status": "affected",
"version": "1.25.2"
},
{
"status": "affected",
"version": "1.25.3"
},
{
"status": "affected",
"version": "1.25.4"
},
{
"status": "affected",
"version": "1.25.5"
},
{
"status": "affected",
"version": "1.25.6"
},
{
"status": "affected",
"version": "1.26.0"
},
{
"status": "affected",
"version": "1.26.1"
},
{
"status": "affected",
"version": "1.26.2"
},
{
"status": "affected",
"version": "1.26.3"
},
{
"status": "affected",
"version": "1.26.4"
},
{
"status": "affected",
"version": "1.26.5"
},
{
"status": "affected",
"version": "1.26.6"
},
{
"status": "affected",
"version": "1.26.7"
},
{
"status": "affected",
"version": "1.26.8"
},
{
"status": "affected",
"version": "1.26.9"
},
{
"status": "affected",
"version": "1.26.10"
},
{
"status": "affected",
"version": "1.26.11"
},
{
"status": "affected",
"version": "1.26.12"
},
{
"status": "affected",
"version": "1.27.0"
},
{
"status": "affected",
"version": "1.27.1"
},
{
"status": "affected",
"version": "1.27.2"
},
{
"status": "affected",
"version": "1.28.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "biniam (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "rmelotte (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T07:27:29.629Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-359840 | Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/359840"
},
{
"name": "VDB-359840 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/359840/cti"
},
{
"name": "CVE-2026-7233 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-7233"
},
{
"name": "Submit #802590 | Artifex MuPDF 1.28 Out-of-Bounds Read",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/802590"
},
{
"tags": [
"issue-tracking"
],
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709328"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/biniamf/pocs/tree/main/mupdf-cff-indexload-oobread"
},
{
"tags": [
"product"
],
"url": "https://artifex.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-27T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-01T08:29:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-7233",
"datePublished": "2026-04-28T06:00:18.874Z",
"dateReserved": "2026-04-27T17:00:07.970Z",
"dateUpdated": "2026-11-01T07:27:29.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15569 (GCVE-0-2025-15569)
Vulnerability from cvelistv5 – Published: 2026-02-10 10:02 – Updated: 2026-02-23 09:54
VLAI
EPSS
VEX
Title
Artifex MuPDF win_main.c get_system_dpi uncontrolled search path
Summary
A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The exploitability is regarded as difficult. Upgrading to version 1.26.2 is sufficient to resolve this issue. Patch name: ebb125334eb007d64e579204af3c264aadf2e244. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-10 14:36 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.344924 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.344924 | signaturepermissions-required |
| https://vuldb.com/?submit.750978 | third-party-advisory |
| https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mup… | patch |
| https://casper.mupdf.com/downloads/archive/mupdf-… | patch |
| https://artifex.com/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15569",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-10T14:36:11.207289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-10T15:00:15.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*"
],
"product": "MuPDF",
"vendor": "Artifex",
"versions": [
{
"status": "affected",
"version": "1.26.0"
},
{
"status": "affected",
"version": "1.26.1"
},
{
"status": "unaffected",
"version": "1.26.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nmaochea (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The exploitability is regarded as difficult. Upgrading to version 1.26.2 is sufficient to resolve this issue. Patch name: ebb125334eb007d64e579204af3c264aadf2e244. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6,
"vectorString": "AV:L/AC:H/Au:S/C:C/I:C/A:C/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "Uncontrolled Search Path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "Untrusted Search Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T09:54:58.415Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-344924 | Artifex MuPDF win_main.c get_system_dpi uncontrolled search path",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.344924"
},
{
"name": "VDB-344924 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.344924"
},
{
"name": "Submit #750978 | Artifex Software MuPDF 1.26.2 Uncontrolled Search Path",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.750978"
},
{
"tags": [
"patch"
],
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=ebb125334eb007d64e579204af3c264aadf2e244"
},
{
"tags": [
"patch"
],
"url": "https://casper.mupdf.com/downloads/archive/mupdf-1.26.2-windows.zip"
},
{
"tags": [
"product"
],
"url": "https://artifex.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-04T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-02-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-02-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-02-16T05:26:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "Artifex MuPDF win_main.c get_system_dpi uncontrolled search path"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-15569",
"datePublished": "2026-02-10T10:02:09.074Z",
"dateReserved": "2026-02-08T08:06:04.188Z",
"dateUpdated": "2026-02-23T09:54:58.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}