CVE-2025-46206 — Uncontrolled Recursion in Mupdf

CWE-674 — Uncontrolled RecursionCWE-400 — Uncontrolled Resource Consumption7 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 49.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Artifex Mupdf
Timeline
PublishedAug 4
Latest updateNov 25

Description

An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶Debianartifex/mupdf< 1.25.1+ds1-7
▶NVDartifex/mupdf1.25.6

🔴Vulnerability Details

4
OSV
mupdf vulnerabilities↗2025-11-25
▶
OSV
CVE-2025-46206: An issue in Artifex mupdf 1↗2025-08-04
▶
CVEList
CVE-2025-46206: An issue in Artifex mupdf 1↗2025-08-04
▶
GHSA
GHSA-m6hm-534h-7mxm: An issue in Artifex mupdf 1↗2025-08-04
▶

📋Vendor Advisories

2
Ubuntu
MuPDF vulnerabilities↗2025-11-25
▶
Debian
CVE-2025-46206: mupdf - An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a den...↗2025
▶
CVE-2025-46206 — Uncontrolled Recursion in Mupdf | cvebase