Is there a public PoC exploit available for CVE-2026-7233?

Yes, a public proof-of-concept exploit is available for CVE-2026-7233. Prioritise patching immediately. EPSS: 0.0%.

Artifex MuPDF CVE-2026-7233

Q: What is the CVSS score of CVE-2026-7233?

CVE-2026-7233 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26000 LOW

Out-of-bounds Read (CWE-125)

2026-04-28 VulDB

Buffer Overflow Information Disclosure Mupdf Artifex

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 29, 2026 - 17:15 vuln.today

Public exploit code

CVSS changed

Apr 28, 2026 - 07:22 NVD

3.3 (LOW) 1.9 (LOW)

Analysis Generated

Apr 28, 2026 - 06:45 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 06:30 euvd

EUVD-2026-26000

Analysis Generated

Apr 28, 2026 - 06:30 vuln.today

CVE Published

Apr 28, 2026 - 06:00 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.

AnalysisAI

Out-of-bounds read in Artifex MuPDF up to version 1.28.0 within the CFF Index Handler's fz_subset_cff_for_gids function allows local attackers with low privileges to disclose sensitive information from application memory. The vulnerability requires local access and low privilege level but can be triggered without user interaction; publicly available exploit code exists and the vulnerability remains unpatched as of the last vendor response.

Technical ContextAI

MuPDF is a lightweight PDF and document viewer library that includes support for parsing Compact Font Format (CFF) font data embedded in PDF files. The CFF Index Handler component processes CFF font subset operations through the fz_subset_cff_for_gids function in subset-cff.c. The vulnerability stems from CWE-125 (Out-of-bounds Read), where the function fails to properly validate array bounds or index calculations when reading CFF font index structures, allowing an attacker to read adjacent memory regions beyond the intended buffer. This is a classic buffer over-read vulnerability in font parsing logic that processes untrusted CFF data from PDF documents.

RemediationAI

No vendor-released patch has been identified at the time of analysis, despite early notification to Artifex through bug tracking. Immediate remediation options are: (1) Upgrade MuPDF to a version newer than 1.28.0 if the vendor releases a patched version after this analysis; (2) For applications embedding MuPDF, apply input validation filtering to reject or sanitize CFF font data in untrusted PDF documents before processing; (3) Implement strict privilege separation - ensure MuPDF processes run with minimal required privileges and isolated from sensitive system data; (4) Restrict CFF font parsing to trusted PDF sources only, disabling CFF subset operations for documents from untrusted origins (this may break PDF rendering of certain fonts); (5) Deploy systems so that low-privilege local users cannot access sensitive data in memory shared with MuPDF processes (requires OS-level memory isolation). Monitor Artifex bug tracker (https://bugs.ghostscript.com/show_bug.cgi?id=709328) and GitHub for patched releases. The current lack of vendor response suggests either extended remediation timeline or potential discontinuation of the product line.