CVE-2025-46206
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
An infinite recursion vulnerability was found in Artifex MuPDF versions 1.25.5 and 1.25.6 within the `mutool clean` utility. A remote attacker can cause a denial of service (DoS) by supplying a crafted PDF file with cyclic /Next references in the outline structure.
Risk Assessment
The risk is the potential for a DoS attack on systems using `mutool clean` to process PDF files, which may lead to hangs or resource exhaustion.
Recommendation
It is recommended to upgrade to the latest version of MuPDF that includes a fix for the infinite recursion. Also avoid processing untrusted PDF files with `mutool clean` without prior validation.
Other vulnerabilities in MuPDF
See all- CVE-2017-6060High
A stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.
- CVE-2017-5991High
An issue was discovered in MuPDF before version 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 related to a NULL pointer dereference in the pdf_run_xobject function during a Fitz fz_paint_pixmap_with_mask painting operation.
- CVE-2016-6525Critical
A heap-based buffer overflow in the pdf_load_mesh_params function in MuPDF can be exploited by remote attackers. Exploiting this vulnerability may lead to denial of service or arbitrary code execution via a large decode array.
- CVE-2025-71382Medium
A vulnerability in MuPDF before version 1.27.0-rc1 allows a DoS attack via a specially crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recursively processes the CSS inheritance chain without a depth limit, exhausting the stack and causing a crash.
- CVE-2026-25556High
A double-free vulnerability in MuPDF versions 1.23.0 through 1.27.0 exists in the fz_fill_pixmap_from_display_list() function during error handling. The function incorrectly drops a caller-owned fz_pixmap pointer in its error path before rethrowing the exception, leading to a double-free that can corrupt the heap and crash the process.
Original NVD description (English source)
An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion