# CVE-2026-7233: A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function…

Source: https://junglewise.ai/threats/cve-2026-7233-a-vulnerability-was-determined-in-artifex-mupdf-up-to-1-28-0-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28  
License: CC BY 4.0 with a link back

CVE-2026-7233 · Severity: low · CVSS 3.3 · Published 2026-04-28

A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.

Technologies: [Artifex Mupdf](https://junglewise.ai/threats/technologies/mupdf). Vendors: [Artifex](https://junglewise.ai/threats/vendors/artifex).

## Quick answers

**Is CVE-2026-7233 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7233 being exploited in the wild.

**How severe is CVE-2026-7233?** Low severity, with a CVSS score of 3.3, published 28 April 2026.

**Which products and versions are affected?** Artifex Mupdf. The advisory does not name versions.

**Is there a fix for CVE-2026-7233?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-7233?** Check whether you run Artifex Mupdf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Artifex Mupdf

## Related threats

- [Artifex MuPDF double free in signature locking](https://junglewise.ai/threats/cve-2026-112036-a-vulnerability-was-detected-in-artifex-mupdf-up-to-1-28-5-this)
- [Artifex MuPDF null pointer dereference in PDF Xref loading](https://junglewise.ai/threats/cve-2026-92413-artifex-mupdf-null-pointer-dereference-in-pdf-xref-loading)
- [Artifex MuPDF ANSI injection in mutool via PDF metadata](https://junglewise.ai/threats/cve-2026-40505-artifex-mupdf-ansi-injection-in-mutool-via-pdf-metadata)
- [Artifex MuPDF double free in fz_fill_pixmap_from_display_list](https://junglewise.ai/threats/cve-2026-25556-artifex-mupdf-double-free-in-fz-fill-pixmap-from-display-list)
- [Artifex MuPDF denial of service in mutool clean utility](https://junglewise.ai/threats/cve-2025-46206-artifex-mupdf-denial-of-service-in-mutool-clean-utility)