EUVD-2026-80896
GHSA-pxvr-c538-2crq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed PDF Xref stream
-
DeliveryDeliver PDF to victim/service
-
ExploitVictim opens file in MuPDF-based app
-
Executionpdf_open_filter dereferences NULL pointer
-
ImpactProcess crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or process an attacker-crafted PDF containing a malformed cross-reference (Xref) structure using an application built on the Artifex MuPDF library; this maps to UI:P - passive user interaction is required, and there is no exposed network service that can be hit unauthenticated without a file being supplied. Impact is limited to a crash of the parsing process (availability only); there is no memory disclosure or code execution. Server-side automated PDF processing pipelines that ingest untrusted PDFs are the most realistically exposed deployments, since they process attacker files without a human decision to open them. |
| Impact | This is a genuinely low-priority issue despite a moderate 5.3 CVSS 4.0 score. The vector (AV:N/AC:L/PR:N/UI:P) combined with the only impact being VA:L (limited availability) confirms the sole consequence is a crash - a NULL pointer dereference (CWE-476) that terminates the parsing process. There is no confidentiality or integrity impact (VC:N/VI:N), so this cannot lead to code execution or data disclosure. A public exploit exists (POC published on the Ghostscript bug tracker, attachment 28434), and the vendor vector carries E:P (Proof-of-Concept exploit maturity), which slightly raises real-world exploitability, but a POC for a DoS crash is far less consequential than one for RCE. No EPSS score, no CISA KEV listing, and no evidence of active exploitation are present. Note the description says 'attack can be launched remotely,' yet the vector requires UI:P (passive user interaction) - reconciled by the realistic delivery path: the victim must open or process a maliciously crafted PDF, so 'remote' means attacker-supplied file rather than unauthenticated network service exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malformed PDF whose cross-reference (Xref) stream triggers the NULL pointer dereference in pdf_open_filter during Xref loading. The victim opens the file in an application built on MuPDF (a viewer, thumbnailer, or server-side PDF processor), causing the process to crash. A proof-of-concept exploit file is publicly available on the Ghostscript bug tracker, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Null pointer dereference in Artifex MuPDF allows a crafted PDF to crash the process that parses it, affecting builds up to commit b6d17493700c621c0e70036980a6ebd06d2202c9. The flaw sits in pdf_open_filter() in pdf-stream.c and is triggered while loading a malformed cross-reference (Xref) structure, so exploitation requires the target application (or automated ingestion pipeline) to process an attacker-supplied PDF - the assessed vector reflects passive user interaction (UI:P) with no confidentiality or integrity impact and only low availability loss. Publicly available exploit code exists (referenced through the Ghostscript/MuPDF bug 709610 attachment), and the vulnerability is not confirmed actively exploited (CISA KEV); EPSS/KEV-based prioritization is not warranted for this crash-only issue, though server-side pipelines that automatically ingest untrusted PDFs are the most realistically exposed deployments.
RemediationAI
Apply the upstream fix commit 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e (https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=3df1e30f9d7b77260e13bd0dbe1928ddeba8386e), which is the patch referenced by the vendor and by VulDB; note that this is an upstream fix commit rather than a confirmed tagged release, so a released patched version is not independently confirmed in the supplied data - rebuild MuPDF from patched source or track the next vendor release containing this commit if you consume a distribution package, and verify which MuPDF revision any third-party library or service bundles before assuming it is fixed. Where patching must be deferred, the effective compensating control is containment rather than feature disabling: run any PDF parsing or conversion in a separate, low-privilege worker process (seccomp/AppArmor confinement, memory and CPU rlimits, no network egress) and treat a worker crash as a non-fatal event that is restarted, since the impact is limited to killing the parsing process - the trade-off is added orchestration complexity and possible throughput loss under hostile inputs. Server-side ingestion pipelines should additionally reject or quarantine oversized and structurally malformed PDFs and cap concurrent parse jobs, while desktop deployments benefit from the fact that the file must be opened interactively (UI:P); the Ghostscript/MuPDF bug report and VulDB entry (https://vuldb.com/vuln/405593, https://bugs.ghostscript.com/show_bug.cgi?id=709610) should be monitored for a released patched version.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MuPDF is a lightweight, dependency-free PDF/XPS/EPUB rendering engine that is embedded in desktop viewers, document converters, and server-side document-processing services. The affected routine, pdf_open_filter() in pdf-stream.c, is part of the stream construction and filter-chain setup path used when resolving objects; the PDF Xref Loading component means the dereference is reached while resolving cross-reference streams referenced by a malformed xref table/stream. The underlying weakness class is CWE-476 (NULL Pointer Dereference): a filter or stream object returned during filter initialization is used without a validity check, so a specially shaped PDF causes the parser to dereference a null pointer and abort. Consistent with the CWE, the impact is confined to process termination - the CVSS:4.0 vector (VC:N/VI:N/VA:L, SC:N/SI:N/SA:N) and the independent CVSS:3.1 assessment (C:N/I:N/A:L) both show no memory disclosure or code execution, and the AT:N/E:P components indicate no additional attack complexity and a public exploit path. The CPE cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:* carries no version bounds, so the practical affected scope is defined by the commit-level reference in the description rather than by a released version range.
Know when Mupdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Crafted PDF must be opened/processed (UI:R), no auth needed (PR:N); NULL deref only crashes the process, so C:N/I:N and A:L, scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote a
An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. Rated high severity (CVSS 7.5)
Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. Rated high severity (CVSS 7.8), this
Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, rela
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted
Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing
In Artifex MuPDF 1.12.0 and earlier, a stack buffer overflow in function pdf_lookup_cmap_full in pdf/pdf-cmap.c could al
Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Po
freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry functi
freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function. Rated
A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute_colo
Exploit-DB