# CVE-2025-71382: Artifex MuPDF uncontrolled recursion in EPUB CSS rendering

Source: https://junglewise.ai/threats/cve-2025-71382-artifex-mupdf-uncontrolled-recursion-in-epub-css-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2025-71382 · Severity: medium · CVSS 6.5 · Published 2026-06-23

MuPDF, a widely used library for viewing PDF, XPS, and eBook documents, is vulnerable to a flaw that can cause applications to crash. By tricking a user into opening a specially crafted EPUB eBook file, an attacker can trigger a system crash, leading to a denial of service. This impact affects any software that relies on MuPDF to display eBook content.

## Quick answers

**Is CVE-2025-71382 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71382 being exploited in the wild.

**How severe is CVE-2025-71382?** Medium severity, with a CVSS score of 6.5, published 23 June 2026.

**Which products and versions are affected?** Artifex Software MuPDF before 1.27.0-rc1.

**Is there a fix for CVE-2025-71382?** A patch was published on 2025-10-19: Fix committed to MuPDF repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71382 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-71382?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled recursion vulnerability exists in MuPDF's EPUB rendering component, specifically within the value_from_inheritable_property() function in css-apply.c. The engine fails to impose a depth limit when recursing through the CSS property inheritance chain for deeply nested HTML elements and inline styles. An attacker can exploit this by providing a maliciously crafted EPUB file containing thousands of nested tags, leading to stack exhaustion and a process crash. The issue is resolved in version 1.27.0-rc1 by replacing the recursive logic with an iterative approach.

## Affected products

- Artifex Software MuPDF before 1.27.0-rc1

## Timeline

- 2025-09-13: disclosed: Initial bug report to Ghostscript Bugzilla
- 2025-10-19: patched: Fix committed to MuPDF repository
- 2026-06-23: advisory: NVD publication date

## References

- [https://bugs.ghostscript.com/show_bug.cgi?id=708840](https://bugs.ghostscript.com/show_bug.cgi?id=708840)
- [https://github.com/ArtifexSoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94e](https://github.com/ArtifexSoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94e)
- [https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0-rc1](https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0-rc1)
- [https://www.vulncheck.com/advisories/mupdf-rc1-stack-exhaustion-dos-via-epub-css-rendering](https://www.vulncheck.com/advisories/mupdf-rc1-stack-exhaustion-dos-via-epub-css-rendering)