medium4.8
CVE-2026-7233
A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the...
Impact
A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Artifex | MuPDF | Versions 1.25.5, 1.26.6, 1.27.0, 1.25.2, 1.26.5, 1.24.10 |
| Artifex | Mupdf | through 1.27.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-82r2-3cm6-cxw2
- https://nvd.nist.gov/vuln/detail/CVE-2026-7233
- https://artifex.com
- https://bugs.ghostscript.com/show_bug.cgi?id=709328
- https://github.com/biniamf/pocs/tree/main/mupdf-cff-indexload-oobread
- https://vuldb.com/submit/802590
- https://vuldb.com/vuln/359840
- https://vuldb.com/vuln/359840/cti
- https://vuldb.com/cve/CVE-2026-7233
- https://artifex.com/