CVE-2026-7233

LOW

Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds

Title source: cna
STIX 2.1

Description

A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-359840 | Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds
https://vuldb.com/vuln/359840
Signature, Permissions Required signature permissions-required
VDB-359840 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/359840/cti
Third Party Advisory third-party-advisory
Submit #802590 | Artifex MuPDF 1.28 Out-of-Bounds Read
https://vuldb.com/submit/802590
Product product
https://artifex.com/

Scores

CVSS v3 3.3
EPSS 0.0024
EPSS Percentile 14.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-125
Status published
Products (30)
artifex/mupdf < 1.27.2
Artifex/MuPDF 1.0
Artifex/MuPDF 1.1
Artifex/MuPDF 1.10
Artifex/MuPDF 1.11
Artifex/MuPDF 1.12
Artifex/MuPDF 1.13
Artifex/MuPDF 1.14
Artifex/MuPDF 1.15
Artifex/MuPDF 1.16
... and 20 more
Published Apr 28, 2026
Tracked Since Apr 28, 2026