CVE-2025-46206
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
An infinite recursion vulnerability was found in Artifex MuPDF versions 1.25.5 and 1.25.6 within the `mutool clean` utility. A remote attacker can cause a denial of service (DoS) by supplying a crafted PDF file with cyclic /Next references in the outline structure.
Risk Assessment
The risk is the potential for a DoS attack on systems using `mutool clean` to process PDF files, which may lead to hangs or resource exhaustion.
Recommendation
It is recommended to upgrade to the latest version of MuPDF that includes a fix for the infinite recursion. Also avoid processing untrusted PDF files with `mutool clean` without prior validation.
Other vulnerabilities in MuPDF
See all- CVE-2026-58971Unknown
In _mupdf_get_hdr of wprint_mupdf.c, there is an out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2017-6060High
A stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.
- CVE-2017-5991High
An issue was discovered in MuPDF before version 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 related to a NULL pointer dereference in the pdf_run_xobject function during a Fitz fz_paint_pixmap_with_mask painting operation.
- CVE-2016-6525Critical
A heap-based buffer overflow in the pdf_load_mesh_params function in MuPDF can be exploited by remote attackers. Exploiting this vulnerability may lead to denial of service or arbitrary code execution via a large decode array.
- CVE-2025-71382Medium
A vulnerability in MuPDF before version 1.27.0-rc1 allows a DoS attack via a specially crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recursively processes the CSS inheritance chain without a depth limit, exhausting the stack and causing a crash.
- CVE-2026-40505Low
MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Malicious ANSI escape codes embedded in PDF metadata are passed unsanitized to terminal output when running mutool info.
- CVE-2026-25556High
A double-free vulnerability in MuPDF versions 1.23.0 through 1.27.0 exists in the fz_fill_pixmap_from_display_list() function during error handling. The function incorrectly drops a caller-owned fz_pixmap pointer in its error path before rethrowing the exception, leading to a double-free that can corrupt the heap and crash the process.
Original NVD description (English source)
An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion
Vulnerability data from NVD (NIST) · CISA KEV · EPSS