# CVE-2026-92413: Artifex MuPDF null pointer dereference in PDF Xref loading

Source: https://junglewise.ai/threats/cve-2026-92413-artifex-mupdf-null-pointer-dereference-in-pdf-xref-loading  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92413 · Severity: medium · CVSS 4.3 · Published 2026-09-16

Artifex MuPDF is a widely-deployed lightweight PDF rendering library used in applications across document processing, scanning, and embedded systems. A null pointer dereference vulnerability in the PDF Xref (cross-reference table) loading function can cause the application to crash when processing a specially crafted PDF file, resulting in denial of service to end users or services relying on the library.

Technologies: [Artifex Mupdf](https://junglewise.ai/threats/technologies/mupdf). Vendors: [Artifex](https://junglewise.ai/threats/vendors/artifex).

## Quick answers

**Is CVE-2026-92413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92413 being exploited in the wild.

**How severe is CVE-2026-92413?** Medium severity, with a CVSS score of 4.3, published 16 September 2026.

**Which products and versions are affected?** Artifex Mupdf up to b6d17493700c621c0e70036980a6ebd06d2202c9.

**Is there a fix for CVE-2026-92413?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92413 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92413?** Check whether you run Artifex Mupdf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a null pointer dereference (CWE-476) in the pdf_open_filter function within the PDF Xref Loading component (pdf-stream.c). The flaw is triggered during the parsing of a malformed PDF's cross-reference stream, where insufficient validation allows a null pointer to be dereferenced. The attack is network-reachable and requires no authentication or user interaction beyond opening a malicious PDF document. An attacker can trigger an application crash (denial of service) by distributing a crafted PDF file. A patch has been published (commit 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e) and should be applied to mitigate the issue.

## Affected products

- Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9

## Timeline

- 2026-09-16: disclosed

## References

- [https://artifex.com/](https://artifex.com/)
- [https://bugs.ghostscript.com/attachment.cgi?id=28434](https://bugs.ghostscript.com/attachment.cgi?id=28434)

## Related threats

- [Artifex MuPDF double free in signature locking](https://junglewise.ai/threats/cve-2026-112036-a-vulnerability-was-detected-in-artifex-mupdf-up-to-1-28-5-this)
- [A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function…](https://junglewise.ai/threats/cve-2026-7233-a-vulnerability-was-determined-in-artifex-mupdf-up-to-1-28-0-the)
- [Artifex MuPDF ANSI injection in mutool via PDF metadata](https://junglewise.ai/threats/cve-2026-40505-artifex-mupdf-ansi-injection-in-mutool-via-pdf-metadata)
- [Artifex MuPDF double free in fz_fill_pixmap_from_display_list](https://junglewise.ai/threats/cve-2026-25556-artifex-mupdf-double-free-in-fz-fill-pixmap-from-display-list)
- [Artifex MuPDF denial of service in mutool clean utility](https://junglewise.ai/threats/cve-2025-46206-artifex-mupdf-denial-of-service-in-mutool-clean-utility)