Description
Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mupdf | 1.9a+ds1-1.2 | — |
| Debian 13 | mupdf | 1.9a+ds1-1.2 | — |
| Debian 12 | mupdf | 1.9a+ds1-1.2 | — |
| Debian 8 | mupdf | 1.5-1+deb8u1 | DSA-3655-1 |
| Debian 7 | mupdf | 0.9-2+deb7u3 | DLA-589-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | mupdf | No fix yet | — |
Advisories 2
- DLA-589-1 mupdf - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3655-1 mupdf - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-3655 vendor-advisory
- [oss-security] 20160803 Re: CVE request:Heap overflow vulns in MuPDF mailing-list
- http://bugs.ghostscript.com/show_bug.cgi?id=696954
- 92266 vdb-entry
- http://git.ghostscript.com/?p=mupdf.git%3Bh=39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e
- GLSA-201702-12 vendor-advisory