artifexsoftware vulnerabilities

Products

• artifexsoftware/mupdf 2
• ghostpdl 1

Latest artifexsoftware CVEs

Newest publication first

1. CVE-2026-125396 Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery

   Published 2026-11-09

   High·CVSS 8.5 EPSS 0.13%

   Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, re...

2. CVE-2025-71382 MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering

   Published 2026-06-23

   High·CVSS 7.1 EPSS 0.58%

   MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function va...

3. CVE-2026-25556 MuPDF 1.23.0 through 1.27.0 Barcode Decoding Double Free

   Published 2026-02-06

   Medium·CVSS 5.9 EPSS 0.53%

   MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.