What is the CVSS score of CVE-2026-3308?

CVE-2026-3308 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mupdf are affected by CVE-2026-3308?

MuPDF 1.27.0 contains a heap overflow vulnerability in PDF image parsing that enables arbitrary code execution when users open maliciously crafted PDF files.

How to fix or mitigate CVE-2026-3308?

Within 24 hours: Identify all systems and applications using MuPDF 1.27.0 (check application manifests, dependencies, and vendor bills of materials). Within 7 days: Contact MuPDF vendor (Artifex) to confirm availability of patched release version beyond 1.27.0 and commit a26f0142e7 status. Communicate interim risk to users and restrict PDF processing from untrusted sources. Within 30 days: Deploy patched MuPDF version once released and confirmed, or implement application-level sandboxing for PDF parsing if no patch timeline is established.

Mupdf CVE-2026-3308

EUVD-2026-17412 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-03-31 certcc

GHSA-6jrq-hjxp-2x5r

Integer Overflow RCE Buffer Overflow Mupdf PyMuPDF

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 21, 2026 - 10:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 10:22 vuln.today

cvss_changed

EUVD ID Assigned

Mar 31, 2026 - 13:48 euvd

EUVD-2026-17412

Analysis Generated

Mar 31, 2026 - 13:48 vuln.today

CVE Published

Mar 31, 2026 - 13:13 nvd

HIGH 7.8

DescriptionCVE.org

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code execution.

AnalysisAI

Heap overflow in MuPDF 1.27.0 PDF parser enables arbitrary code execution when victims open maliciously crafted PDF files. Integer overflow in pdf_load_image_imp function allows heap-based buffer overflow through crafted PDF image objects. Upstream fix committed (a26f0142e7) but packaged release version unconfirmed. EPSS probability low (0.02%, 4th percentile) indicates theoretical risk without active exploitation campaigns. Requires local file access and user interaction (opening malicious PDF), limiting remote attack scenarios but viable for phishing/watering hole attacks.

Technical ContextAI

MuPDF is a lightweight PDF and XPS viewer library from Artifex Software, commonly embedded in applications requiring PDF rendering capabilities. The vulnerability resides in pdf-image.c within the pdf_load_image_imp function, which handles image object parsing from PDF streams. CWE-190 (Integer Overflow) occurs when processing malformed image dimensions or buffer size calculations, causing wraparound to small allocation sizes while subsequent write operations use the original large values. This classic integer-to-buffer-overflow pattern produces heap corruption beyond allocated boundaries. CPE string indicates vulnerability affects MuPDF versions through 1.27.0, including PyMuPDF Python bindings that wrap the native library. The PDF specification's flexibility in image encoding formats (JPEG, JPEG2000, JBIG2, raw samples) creates complex parsing paths where integer validation failures can occur.

RemediationAI

Upstream fix available in commit a26f0142e7d390d4a82c6e5ae0e312e07cc4ec85 at both GitHub (github.com/ArtifexSoftware/mupdf) and Ghostscript cgit repository. Debian has issued security updates per debian-lts-announce list (April 2026). Organizations should upgrade to patched MuPDF versions distributed through their package managers or build from source incorporating commit a26f0142e7 or later. For systems where immediate patching is infeasible, implement defense-in-depth controls: (1) process untrusted PDFs in sandboxed environments (containers, VMs, or browser-based viewers with process isolation), accepting performance overhead; (2) deploy application allowlisting to prevent execution of unexpected child processes from PDF viewers; (3) disable automatic PDF preview/thumbnail generation in file managers and email clients, requiring explicit user action to render; (4) use SELinux/AppArmor mandatory access control to restrict PDF viewer capabilities even if exploitation succeeds. For server-side PDF processing, consider alternative libraries (e.g., Poppler, pdf.js in headless browser) until MuPDF updates are validated, though this introduces migration complexity and potential feature gaps.