EUVD-2025-210322
GHSA-mhwh-83qc-j6x4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft EPUB with deeply nested HTML/CSS
-
DeliveryDeliver via email, download, or upload pipeline
-
ExploitVictim opens file in MuPDF-based reader
-
ExecutionCSS inheritance walk recurses in value_from_inheritable_property()
-
PersistThread stack exhausted
-
ImpactProcess crashes, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires the target application to actually invoke MuPDF's EPUB (HTML/CSS) renderer on attacker-supplied content, and a user or automated pipeline must open or ingest the crafted .epub file (CVSS UI:P passive interaction). The malicious EPUB must contain HTML elements nested deeply enough that the CSS inheritance walk in value_from_inheritable_property() recurses past the thread's stack limit, and inline CSS using inherited or 'inherit' properties to force the lookup. Limiting factors: PDF-only or XPS-only MuPDF deployments that never instantiate the EPUB engine are unaffected, exploitation yields denial of service only (VC:N/VI:N, VA:H) with no code execution or data disclosure, and applications running MuPDF with generous per-thread stacks or sandboxed worker restart logic will recover automatically. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) accurately captures the situation: network-delivered, low complexity, no authentication, but passive user interaction is required to open the EPUB, and impact is limited to availability with no confidentiality or integrity loss. Publicly available exploit code exists (referenced via Ghostscript Bugzilla 708840) and a VulnCheck advisory has been published, yet the CVE is not in CISA KEV and no EPSS score was supplied. Real-world priority is moderate: the bug is trivially weaponizable into a crash but yields only a process kill, so it matters most for server-side EPUB conversion pipelines or unattended document workflows where a crash translates into denial of service; for a desktop reader it is a nuisance the user can recover from by closing the document. |
| Exploit ScenarioDerived | An attacker emails or hosts a booby-trapped EPUB whose XHTML body contains hundreds of nested <div> elements each carrying an inline CSS declaration that inherits a property up the chain. When a victim opens the file in any MuPDF-based reader, or a backend conversion service ingests it, value_from_inheritable_property() recurses through every ancestor for each lookup, blows the thread stack and segfaults the process. Publicly available exploit code exists via the Artifex/Ghostscript bug tracker, so reproduction is trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Denial of service in MuPDF before 1.27.0-rc1 allows remote attackers to crash any application embedding the library for EPUB rendering by supplying a crafted EPUB file containing deeply nested HTML elements and inline CSS. The flaw lives in the CSS property inheritance walker (value_from_inheritable_property() in css-apply.c), which recurses without a depth bound and exhausts the process stack. Publicly available exploit code exists via the Artifex bug tracker, but the issue is not listed in CISA KEV and CVSS 4.0 base is 7.1 (availability-only impact).
RemediationAI
Vendor-released patch: upgrade MuPDF to 1.27.0-rc1 or any later release that includes commit 70b71ab22e6de4d4c44cd301c88231f623a4e94e, which rewrites value_from_inheritable_property() to iterate rather than recurse; downstream maintainers that vendor MuPDF should cherry-pick that single commit. If immediate upgrade is not possible, disable EPUB ingestion in the embedding application or refuse EPUB files from untrusted sources at the gateway, accepting the trade-off that legitimate EPUB content will also be blocked. For server-side conversion pipelines, additionally run MuPDF in a sandboxed worker with a short watchdog timer and automatic restart so a single crashed worker does not interrupt the queue. Vendor advisory and commit are at https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0-rc1 and https://github.com/ArtifexSoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94e.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MuPDF is Artifex Software's lightweight C library and viewer for rendering PDF, XPS, and EPUB documents, embedded in many third-party readers (SumatraPDF, KOReader, zathura-mupdf, and Artifex's own mupdf and mutool binaries). The root cause is CWE-674 (Uncontrolled Recursion): when the EPUB engine resolves a CSS property that is marked 'inherit' or unset, value_from_inheritable_property() recursively calls itself walking the match->up parent chain. With deeply nested DOM/CSS structures the call depth grows linearly with nesting and overruns the thread stack. The upstream commit 70b71ab22e6de4d4c44cd301c88231f623a4e94e rewrites the function as a bounded while-loop that walks match->up iteratively, eliminating the unbounded stack frames entirely.
Know when Mupdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-delivered EPUB, low complexity, no privileges, user must open the file (UI:R), and impact is limited to a process crash so only A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.
Executive ViewAI
MuPDF, a widely-embedded document processing library, contains a denial-of-service vulnerability affecting any application that handles EPUB files. Attackers with publicly available exploit code can crash vulnerable systems by submitting specially crafted EPUB documents, directly impacting service availability for organizations that depend on EPUB processing in their workflows. This represents an immediate operational risk given the public availability of working exploits.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote a
An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. Rated high severity (CVSS 7.5)
Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. Rated high severity (CVSS 7.8), this
Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, rela
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted
Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing
In Artifex MuPDF 1.12.0 and earlier, a stack buffer overflow in function pdf_lookup_cmap_full in pdf/pdf-cmap.c could al
Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Po
freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry functi
freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function. Rated
A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute_colo
Exploit-DB