Read the docs
TI-2026-06350 Aliases CVE-2026-7233GHSA-82r2-3cm6-cxw2

Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds

Priority MEDIUM 55CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00238 14th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ArtifexMuPDF1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; 1.24.5; 1.24.6; 1.24.7; 1.24.8; 1.24.9; 1.24.10; 1.24.11; 1.25.0; 1.25.1; 1.25.2; 1.25.3; 1.25.4; 1.25.5; 1.25.6; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; 1.26.5; 1.26.6; 1.26.7; 1.26.8; 1.26.9; 1.26.10; 1.26.11; 1.26.12; 1.27.0; 1.27.1; 1.27.2; 1.28.0—No fix listedCNA
  • MuPDF VendorArtifex Affected 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; 1.24.5; 1.24.6; 1.24.7; 1.24.8; 1.24.9; 1.24.10; 1.24.11; 1.25.0; 1.25.1; 1.25.2; 1.25.3; 1.25.4; 1.25.5; 1.25.6; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; 1.26.5; 1.26.6; 1.26.7; 1.26.8; 1.26.9; 1.26.10; 1.26.11; 1.26.12; 1.27.0; 1.27.1; 1.27.2; 1.28.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*up to 1.27.2VulnerableArtifex
  • cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:* Versions up to 1.27.2 Vulnerable ·Artifex

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7233
  2. 2026-10-03 Alias added: GHSA-82r2-3cm6-cxw2
  3. 2026-11-01 Affected versions changed · CNA

References

Exploit 2

Other 1

  • TI-2024-16051 freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable… CVSS 3.1HIGH 7.5
  • TI-2023-27942 A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF… CVSS 3.1HIGH 7.5
  • TI-2021-02374 Double free in mupdf CVSS 3.1HIGH 7.8
  • TI-2016-07185 Out-of-bounds write in Artifex MuPDF CVSS 3.1HIGH 7.8
  • TI-2012-04514 SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the… CVSS 3.1HIGH 7.8
  • TI-2023-27939 A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF… CVSS 3.1HIGH 7.5
See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences