Description
A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Artifex | MuPDF | 1.24.0, 1.24.1, 1.24.2, 1.24.3, 1.24.4, 1.24.5, 1.24.6, 1.24.7, 1.24.8, 1.24.9, 1.24.10, 1.24.11, 1.25.0, 1.25.1, 1.25.2, 1.25.3, 1.25.4, 1.25.5, 1.25.6, 1.26.0, 1.26.1, 1.26.2, 1.26.3, 1.26.4, 1.26.5, 1.26.6, 1.26.7, 1.26.8, 1.26.9, 1.26.10, 1.26.11, 1.26.12, 1.27.0, 1.27.1, 1.27.2, 1.28.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mupdf | No fix yet | — |
| Debian 13 | mupdf | No fix yet | — |
| Debian 12 | mupdf | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | mupdf | No fix yet | — |
| Ubuntu 26.04 LTS | mupdf | No fix yet | — |
| Ubuntu 25.10 | mupdf | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | mupdf | No fix yet | — |
| Ubuntu Pro 22.04 LTS | mupdf | No fix yet | — |
| Ubuntu Pro 20.04 LTS | mupdf | No fix yet | — |
| Ubuntu Pro 18.04 LTS | mupdf | No fix yet | — |
| Ubuntu Pro 16.04 LTS | mupdf | No fix yet | — |
References
- VDB-359840 | Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds vdb-entry technical-description
- VDB-359840 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-7233 | CVE Analysis and Report third-party-advisory
- Submit #802590 | Artifex MuPDF 1.28 Out-of-Bounds Read third-party-advisory
- https://bugs.ghostscript.com/show_bug.cgi?id=709328 issue-tracking
- https://github.com/biniamf/pocs/tree/main/mupdf-cff-indexload-oobread exploit
- https://artifex.com/ product