Description
An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Artifex Software Inc. *PyMuPDF* MuPDF
0 to ≤ 1.27.0affected
References
- https://github.com/ArtifexSoftware/mupdf/commit/a26f0142e7d390d4a82c6e5ae0e312e07cc4ec85 ↗
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=a26f0142e7d390d4a82c6e5ae0e312e07cc4ec85 ↗
- https://github.com/ArtifexSoftware/mupdf ↗
- https://www.kb.cert.org/vuls/id/951662 ↗
- https://lists.debian.org/debian-lts-announce/2026/04/msg00020.html ↗