CVE-2026-92413 in MuPDF
Summary
by MITRE • 09/16/2026
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Artifex MuPDF, specifically within the PDF Xref Loading component and affecting versions up to commit b6d17493700c621c0e70036980a6ebd06d2202c9, represents a critical security flaw rooted in improper input validation during the processing of PDF cross-reference tables. The core technical issue resides within the pdf_open_filter function located in the source file pdf-stream.c. This function is responsible for initializing and managing various filters used to decompress or decode data streams within a PDF document. When parsing these structures, the software fails to adequately verify the integrity and validity of certain parameters before attempting to access memory pointers associated with filter instances. Consequently, if an attacker provides a specially crafted PDF file containing malformed stream definitions, the application may attempt to dereference a null pointer. This specific failure mode is classified under CWE-476, which denotes NULL Pointer Dereference, indicating that the program attempts to use a pointer that has not been initialized or has been explicitly set to null, leading to unpredictable behavior and typically an immediate crash of the processing thread or application.
From an operational perspective, this vulnerability allows for remote exploitation without requiring user authentication, significantly expanding its attack surface. An attacker can host a malicious PDF file on a web server or distribute it via email attachments, relying on social engineering or automated scanning tools to trigger the flaw when a victim opens the document using a vulnerable version of MuPDF. The successful execution of this exploit results in a denial of service condition due to the application crash caused by the null pointer dereference. While modern operating systems often mitigate the impact of such crashes through exception handling and core dump generation, preventing arbitrary code execution directly from this specific flaw is likely unless it serves as part of a more complex chain involving other memory corruption vulnerabilities. However, the stability of any software relying on MuPDF for PDF rendering or processing is severely compromised, potentially disrupting workflows in environments where automated document parsing occurs.
The existence of published exploits further elevates the risk profile associated with this vulnerability. Attackers can leverage these publicly available proof-of-concept codes to reliably reproduce the crash condition against unpatched systems. This availability lowers the barrier to entry for malicious actors who may not possess advanced reverse engineering skills, enabling widespread automated attacks targeting organizations that have not yet applied security updates. The impact extends beyond simple application instability; in server-side contexts where MuPDF is used for batch processing or document conversion services, repeated exploitation attempts could lead to resource exhaustion if crash recovery mechanisms are inefficient, thereby affecting service availability for legitimate users.
To mitigate this risk, immediate action is required by applying the patch identified as commit 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e to all systems running affected versions of Artifex MuPDF. This update addresses the root cause within pdf-stream.c by implementing stricter validation checks before dereferencing pointers related to PDF filters. Organizations should prioritize updating their libraries and applications that depend on this component, particularly those involved in document management, email security gateways, or web-based PDF viewers. Additionally, deploying network-level controls such as intrusion detection systems configured with signatures for known exploit patterns can provide an additional layer of defense by blocking malicious traffic attempting to deliver the crafted payloads before they reach vulnerable endpoints. Continuous monitoring and regular patching cycles are essential to maintain resilience against evolving threats targeting document processing libraries.