Artifex MuPDF EUVD-2026-26000

Exploitation requires the following concrete prerequisites: (1) Local system access as a low-privilege user account (PR:L in CVSS vector); (2) Ability to provide a malformed PDF document to an application that uses the vulnerable MuPDF library - this may be achieved by uploading a file to a document processing service, emailing a PDF to a recipient, or placing a file in a shared directory; (3) The MuPDF application must attempt to parse or subset CFF font data from the malicious PDF, which occurs automatically during normal PDF rendering unless CFF font handling is explicitly disabled; (4) The vulnerable versions (up to 1.28.0) must be deployed - systems running newer versions (if released) would not be affected. Limiting factors: No remote exploitation possible (AV:L restricts to local-only); no unauthenticated exploitation (PR:L requires valid user account on the system); no user interaction required beyond normal document opening (UI:N); no escalation of privilege needed (attack remains within low-privilege context). The vulnerability does NOT require special configuration settings or non-default deployment modes - standard MuPDF use is sufficient.

The CVSS 3.3 base score reflects low severity with limited real-world impact: local-only attack vector (AV:L) and requirement for low-privilege user account (PR:L) substantially reduce exploitability compared to network-accessible vulnerabilities. The CVSS vector indicates no integrity or availability impact (I:N/A:N), with confidentiality impact limited to low (C:L), typically meaning disclosure of application-local data rather than system-wide secrets. However, the E:P (exploit PoC publicly available) temporal metric increases practical risk slightly. The EPSS score is not provided, but given the combination of low CVSS and strict local+authenticated prerequisites, real-world exploitation risk appears limited to scenarios where an attacker has already achieved local access and user-level privilege. The unpatched status and public PoC availability create a persistent low-background risk for systems running vulnerable versions, but this is primarily a defense-in-depth concern rather than an urgent critical issue. The information disclosure potential (memory read) could expose application secrets or PDF contents in multi-user systems where privilege isolation is weak.

An attacker with local user-level access on a multi-user system crafts a malicious PDF file containing specially crafted CFF font subset data that triggers an out-of-bounds read in fz_subset_cff_for_gids. When an application using MuPDF processes this PDF (e.g., via a document service, preview API, or user action), the function reads beyond buffer boundaries and exposes adjacent application memory containing sensitive data such as other users' document content, encryption keys, or application secrets. The attacker retrieves this disclosed information via timing side-channels, crash dumps, or error messages. Publicly available exploit code from the GitHub repository (https://github.com/biniamf/pocs/tree/main/mupdf-cff-indexload-oobread) demonstrates the attack vector.