CVE-2026-7233

Description

A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.

Weakness classification

• CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-125: Out-of-bounds Read

Primary references

• cna@vuldb.com — Product
• cna@vuldb.com — Exploit, Mitigation, Third Party Advisory
• cna@vuldb.com — Exploit
• cna@vuldb.com — Exploit, Mitigation, Third Party Advisory, VDB Entry
• cna@vuldb.com — Exploit, Mitigation, Third Party Advisory, VDB Entry
• cna@vuldb.com — Permissions Required, VDB Entry
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Mitigation, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Mitigation, Third Party Advisory, VDB Entry