Mupdf CVE-2026-3308

Exploitation requires victim to open attacker-controlled PDF file using MuPDF 1.27.0 or earlier in an application that invokes the pdf_load_image_imp function during rendering. Specifically affects PDFs containing embedded image objects (standard feature in most PDFs with graphics). No special MuPDF configuration required-default installation is vulnerable. User interaction mandatory (UI:R in CVSS vector): victim must explicitly open file or application must auto-render PDF (preview panes, thumbnail generation). Local access required (AV:L): attacker cannot exploit remotely without first delivering malicious file through email attachment, web download, file share, or removable media. Exploitation limited by: (1) operating system ASLR/DEP making reliable code execution more complex but not impossible; (2) sandboxing in some PDF viewers (Adobe Reader, Chrome PDF viewer) isolating MuPDF if used as rendering backend; (3) SELinux/AppArmor policies restricting viewer process capabilities on hardened systems.

CVSS 7.8 (High) reflects significant impact potential (code execution with full confidentiality/integrity/availability compromise) but critical limiting factors reduce practical risk. Attack vector Local (AV:L) with required user interaction (UI:R) means exploitation demands social engineering to deliver malicious PDF and convince target to open it-cannot be exploited remotely against server components. Attack complexity Low (AC:L) and no privileges required (PR:N) indicate reliable exploitation once file is opened. EPSS 0.02% (4th percentile) confirms security community assessment of low real-world exploitation probability, consistent with lack of CISA KEV listing. No public exploit identified at time of analysis, though commit a26f0142e7 provides technical details enabling POC development. SSVC assessment: exploitation status POC-likely, automatable NO (requires user action), technical impact TOTAL (arbitrary code execution). Real-world risk is MODERATE-serious vulnerability in widely deployed PDF library but attack surface limited to local file handling, not network services. Organizations using MuPDF in automated server-side PDF processing face elevated risk if untrusted PDFs are processed without sandboxing. Desktop users face phishing risk but typical defense-in-depth (email filtering, endpoint protection) provides layered mitigation.

Attacker crafts malicious PDF with specially formatted image object containing oversized dimension values designed to trigger integer overflow in pdf_load_image_imp buffer size calculation. Delivers PDF via phishing email, malicious website download, or compromised file share. When victim opens PDF in MuPDF-based viewer, parser allocates undersized heap buffer due to integer wraparound, then writes image data beyond allocation boundaries. Heap corruption overwrites adjacent structures (vtable pointers, function pointers, or memory management metadata) enabling control-flow hijacking to execute attacker-supplied shellcode with privileges of PDF viewer process. Publicly available commit a26f0142e7 provides exploitation blueprint for developing reliable POC.