CVE-2026-7233
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability was found in Artifex MuPDF, specifically an out-of-bounds read in the fz_subset_cff_for_gids function of subset-cff.c, which handles CFF indexes. The attack requires local access, and the exploit has been publicly disclosed. The project was notified but has not responded.
Risk Assessment
A local attacker could exploit this flaw to read memory outside intended bounds, potentially leading to information disclosure or application instability. The public disclosure of the exploit increases the risk of exploitation.
Recommendation
Monitor official MuPDF updates and apply the patch as soon as it becomes available. Until then, limit local trust in processed CFF files and consider additional memory protection mechanisms.
Other vulnerabilities in Artifex MuPDF
See all- CVE-2017-17866High
Artifex MuPDF before version 1.12.0 mishandles certain length changes during a repair operation in pdf/pdf-write.c, which can lead to buffer overflow and application crash.
- CVE-2017-15587High
An integer overflow was discovered in pdf_read_new_xref_section in Artifex MuPDF 1.11.
- CVE-2017-15369High
The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before September 25, 2017, mishandles a case where a variable may reside in a register. This allows remote attackers to cause a denial of service or possibly other unspecified impacts via a crafted PDF document.
- CVE-2017-14687High
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue arises from mishandling of XML tag name comparisons.
- CVE-2017-14686High
Artifex MuPDF version 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue arises from the lack of checks for negative size fields in a ZIP entry.
- CVE-2017-14685High
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue is related to the xps_load_links_in_glyphs function, which does not verify that an xps font could be loaded.
- CVE-2026-112036Medium
A vulnerability was detected in Artifex MuPDF in the free_char_list function (source/pdf/pdf-xref.c) within the Signature Locking component. The manipulation results in a double free. The exploit is public and can be initiated remotely; a patch named 3984925b660afb8a781ddf504021e91be1bc671e is available.
- CVE-2026-92413Medium
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9 in the function pdf_open_filter of the file pdf-stream.c of the PDF Xref Loading component. Executing a manipulation can lead to a null pointer dereference, and the attack can be launched remotely.
Original NVD description (English source)
A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS