Submit #940975: Artifex Software MuPDF mutool commit b6d17493700c621c0e70036980a6ebd06d2202c9 NULL pointer dereference

Affected Versions
MuPDF master commit b6d17493700c621c0e70036980a6ebd06d2202c9: reproduced with AddressSanitizer.
The include/mupdf/fitz/version.h at that commit defines FZ_VERSION as 1.29.0; Bugzilla lists the version as master.
The issue was closed by commit 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e.
Classification
Vulnerability type: NULL pointer dereference
Attack type: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Exploit availability: Public proof-of-concept
Proven impact: Application crash and loss of availability
Suggested severity: Medium
CVSS 3.1 score: 5.5
CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Technical Description
MuPDF mutool contains a NULL pointer dereference during PDF xref loading. When a PDF xref stream declares an external file reference through an /F entry and no document archive is set, pdf_open_filter() warns and returns NULL. pdf_read_new_xref() passes that NULL stream to pdf_read_new_xref_section(), which calls fz_is_eof(ctx, stm) without a NULL check. The dereference reads address 0x20 and aborts the process.

The crash occurs while the document is being opened, before page rendering, so mutool commands that open a PDF (clean, draw, convert, extract, info, show, merge, and similar) can be affected. The demonstrated impact is a reliable single-file denial of service.

This package includes locally reproduced AddressSanitizer logs (asan-709610.txt for clean, asan-709610-draw.txt for draw) from an Ubuntu WSL2 build of commit b6d17493700c621c0e70036980a6ebd06d2202c9; both commands exit with code 134.

Proof of Concept
PoC file: crash_min.pdf (85 bytes)
PoC attachment: https://bugs.ghostscript.com/attachment.cgi?id=28434
Submission archive: crash_min.zip

Commands:

./build/sanitize/mutool clean crash_min.pdf /dev/null
./build/sanitize/mutool draw -F txt -o /dev/null crash_min.pdf

Observed sanitizer result:

warning: unknown PDF version: 6.0
syntax error: expected object number
warning: Cannot open external file resource without an archive
AddressSanitizer:DEADLYSIGNAL
==PID==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020
The signal is caused by a READ memory access.
Hint: address points to the zero page.
#0 fz_is_eof include/mupdf/fitz/stream.h
#1 pdf_read_new_xref_section source/pdf/pdf-xref.c:1431
#2 pdf_read_new_xref source/pdf/pdf-xref.c:1533
#3 pdf_read_xref source/pdf/pdf-xref.c:1583
#4 read_xref_section source/pdf/pdf-xref.c:1598
#5 pdf_read_xref_sections source/pdf/pdf-xref.c:1673
#6 pdf_load_xref source/pdf/pdf-xref.c:1782
#7 pdf_init_document source/pdf/pdf-xref.c:1958
#8 pdf_open_document_with_dir source/pdf/pdf-xref.c:3304
#9 pdf_clean_file source/pdf/pdf-clean-file.c:556
#10 pdfclean_main source/tools/pdfclean.c:302
#11 main source/tools/mutool.c:158
SUMMARY: AddressSanitizer: SEGV include/mupdf/fitz/stream.h in fz_is_eof
ABORTING

Root Cause
The vulnerable pdf_open_filter() path handles an external stream without an archive by issuing fz_warn() and returning NULL. The caller pdf_read_new_xref() does not check the return value before passing it to pdf_read_new_xref_section(), and pdf_read_new_xref_section() dereferences the stream through fz_is_eof().

The missing failure propagation converts a recoverable, invalid PDF state into a NULL pointer dereference.

Countermeasure
Upgrade to a MuPDF build containing commit 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e:

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=3df1e30f9d7b77260e13bd0dbe1928ddeba8386e

The patch changes the no-archive external stream path to throw:

- fz_warn(ctx, "Cannot open external file resource without an archive");
- return NULL;
+ fz_throw(ctx, FZ_ERROR_ARGUMENT, "cannot open external file resource without an archive");

Until an upgrade is available, avoid opening untrusted PDF files with mutool, run PDF processing in a low-privilege sandbox, and quarantine inputs that crash a worker.

References
Advisory/report: https://bugs.ghostscript.com/show_bug.cgi?id=709610
PoC: https://bugs.ghostscript.com/attachment.cgi?id=28434
Fix: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=3df1e30f9d7b77260e13bd0dbe1928ddeba8386e
Affected commit: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=b6d17493700c621c0e70036980a6ebd06d2202c9
Project: https://mupdf.com/

• Source: ⚠️ https://bugs.ghostscript.com/show_bug.cgi?id=709610
• User: fczhang (UID 97720)
• Submission: 08/20/2026 18:05 (27 days ago)
• Moderation: 09/16/2026 11:33 (27 days later)
• Status: Accepted
• VulDB entry: 405593 [Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9 PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference]
• Points: 17