Executive brief
Artifex MuPDF is a widely-deployed lightweight PDF rendering library used in applications across document processing, scanning, and embedded systems. A null pointer dereference vulnerability in the PDF Xref (cross-reference table) loading function can cause the application to crash when processing a specially crafted PDF file, resulting in denial of service to end users or services relying on the library.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the pdf_open_filter function within the PDF Xref Loading component (pdf-stream.c). The flaw is triggered during the parsing of a malformed PDF's cross-reference stream, where insufficient validation allows a null pointer to be dereferenced. The attack is network-reachable and requires no authentication or user interaction beyond opening a malicious PDF document. An attacker can trigger an application crash (denial of service) by distributing a crafted PDF file. A patch has been published (commit 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e) and should be applied to mitigate the issue.
Affected products
- Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9
Timeline
- 2026-09-16: disclosed