Skip to content
OpenAdvisories
High USN-7631-1 1 CVE

djvulibre vulnerability

Published Jul 9, 2025 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that DjVuLibre incorrectly handled certain memory
operations. If a user or automated system were tricked into processing a
specially crafted DjVu file, a remote attacker could cause applications
to stop responding or crash, resulting in a denial of service, or possibly
execute arbitrary code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS djvulibre 3.5.28-2ubuntu0.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS djvulibre 3.5.28-2ubuntu0.24.04.1

Vulnerabilities 1

  • High 8.4
    CVE-2025-53367 Public exploit

    DjVuLibre OOB-Write Vulnerability in MMRDecoder

    DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays with…

    DjvuNet DjVuLibre djvulibre djvulibre Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2025-53367