Debian Mupdf vulnerabilities

CVE-2026-3308 [HIGH] CVE-2026-3308: mupdf - An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.... An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code execution. Scope: local bookworm: open bullseye: open forky: open sid: open trix

CVE-2026-25556 [MEDIUM] CVE-2026-25556: mupdf - MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_f... MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_dec

CVE-2025-55780 [HIGH] CVE-2025-55780: mupdf - A null pointer dereference occurs in the function break_word_for_overflow_wrap()... A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial nod

CVE-2025-46206 [MEDIUM] CVE-2025-46206: mupdf - An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a den... An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion Scope: local bookworm: open bullseye: open forky: resolved (fix

CVE-2024-46657 [MEDIUM] CVE-2024-46657: mupdf - Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault vi... Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 1.25.1+ds1-5) sid: resolved (fixed in 1.25.1+ds1-5) trixie: resolved (fixed in 1.25.1+d

CVE-2023-51105 [HIGH] CVE-2023-51105: mupdf - A floating point exception (divide-by-zero) vulnerability was discovered in Arti... A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function bmp_decompress_rle4() of load-bmp.c. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2023-51106 [HIGH] CVE-2023-51106: mupdf - A floating point exception (divide-by-zero) vulnerability was discovered in mupd... A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function pnm_binary_read_image() of load-pnm.c when fz_colorspace_n returns zero. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2023-51107 [HIGH] CVE-2023-51107: mupdf - A floating point exception (divide-by-zero) vulnerability was discovered in Arti... A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute_color() of jquant2.c. NOTE: this is disputed by the supplier because there was not reasonable evidence to determine the existence of a vulnerability or identify the affected product. Scope: local bookworm: open bullseye: open forky: open sid: open trixie

CVE-2023-31794 [MEDIUM] CVE-2023-31794: mupdf - MuPDF v1.21.1 was discovered to contain an infinite recursion in the component p... MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 1.22.1+ds1-1) sid: resolved (fixed in 1.22.1+ds1-1) trixie: resolved (fixed in 1.22.1+ds1-1)

CVE-2023-51103 [HIGH] CVE-2023-51103: mupdf - A floating point exception (divide-by-zero) vulnerability was discovered in Arti... A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in the function fz_new_pixmap_from_float_data() of pixmap.c. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2023-51104 [HIGH] CVE-2023-51104: mupdf - A floating point exception (divide-by-zero) vulnerability was discovered in Arti... A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm_binary_read_image() of load-pnm.c when span equals zero. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2021-37220 [MEDIUM] CVE-2021-37220: mupdf - MuPDF through 1.18.1 has an out-of-bounds write because the cached color convert... MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consider the maximum key size of a hash table. This can, for example, be seen with crafted "mutool draw" input. Scope: local bookworm: resolved (fixed in 1.17.0+ds1-2) bullseye: resolved (fixed in 1.17.0+ds1-2) forky: resolved (fixed in 1.17.0+ds1-2) sid: resolved (f

CVE-2021-3407 [MEDIUM] CVE-2021-3407: mupdf - A flaw was found in mupdf 1.18.0. Double free of object during linearization may... A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other potential consequences. Scope: local bookworm: resolved (fixed in 1.17.0+ds1-1.3) bullseye: resolved (fixed in 1.17.0+ds1-1.3) forky: resolved (fixed in 1.17.0+ds1-1.3) sid: resolved (fixed in 1.17.0+ds1-1.3) trixie: resolved (fixed in 1.17.0+ds1-1.3)

CVE-2021-4216 [MEDIUM] CVE-2021-4216: mupdf - A Floating point exception (division-by-zero) flaw was found in Mupdf for zero w... A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream. Scope: local bookworm: resolved (fixed in 1.20.0+ds1-1) bullseye: open forky: resolved (fixed in 1.20.0+ds1-1) sid: resolved (fixed in 1.20.0+ds1-1) trixie: resolved (fixed in 1.20.0+ds1-1)

CVE-2020-16600 [HIGH] CVE-2020-16600: mupdf - A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.... A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.17.0-rc1 and earlier when a valid page was followed by a page with invalid pixmap dimensions, causing bander - a static - to point to previously freed memory instead of a newband_writer. Scope: local bookworm: resolved (fixed in 1.17.0+ds1-1) bullseye: resolved (fixed in 1.17.0+ds1-1) fork

CVE-2020-21896 [MEDIUM] CVE-2020-21896: mupdf - A Use After Free vulnerability in svg_dev_text_span_as_paths_defs function in so... A Use After Free vulnerability in svg_dev_text_span_as_paths_defs function in source/fitz/svg-device.c in Artifex Software MuPDF 1.16.0 allows remote attackers to cause a denial of service via opening of a crafted PDF file. Scope: local bookworm: resolved (fixed in 1.19.0+ds1-1) bullseye: resolved (fixed in 1.17.0+ds1-2+deb11u1) forky: resolved (fixed in 1.19.0+ds1-

CVE-2020-19609 [MEDIUM] CVE-2020-19609: mupdf - Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_co... Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when parsing TIFF files allowing attackers to cause a denial of service. Scope: local bookworm: resolved (fixed in 1.17.0+ds1-2) bullseye: resolved (fixed in 1.17.0+ds1-2) forky: resolved (fixed in 1.17.0+ds1-2) sid: resolved (fixed in 1.17.0+ds1-2) trixie: resolved (fi

CVE-2020-26519 [MEDIUM] CVE-2020-26519: mupdf - Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG... Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service. Scope: local bookworm: resolved (fixed in 1.17.0+ds1-1.1) bullseye: resolved (fixed in 1.17.0+ds1-1.1) forky: resolved (fixed in 1.17.0+ds1-1.1) sid: resolved (fixed in 1.17.0+ds1-1.1) trixie: resolved (fixed in 1.17.0+ds1-1.1)

CVE-2020-26683 [MEDIUM] CVE-2020-26683: mupdf - A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF ... A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF 1.17.0 allows attackers to obtain sensitive information. Scope: local bookworm: resolved (fixed in 1.19.0+ds1-1) bullseye: open forky: resolved (fixed in 1.19.0+ds1-1) sid: resolved (fixed in 1.19.0+ds1-1) trixie: resolved (fixed in 1.19.0+ds1-1)

CVE-2019-13290 [HIGH] CVE-2019-13290: mupdf - Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node ... Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node. Scope: local bookworm: resolved (fixed in 1.15.0+ds1-1) bullseye: resolved (fixed