Heap-Based Buffer Over-Read in Artifex MuPDF Affected by Missing String Check
CVE-2019-14975
7.1HIGH
What is CVE-2019-14975?
Artifex MuPDF versions before 1.16.0 are susceptible to a heap-based buffer over-read due to inadequate validation of strings in certain PDF operations. This vulnerability emerges from the 'fz_chartorune' function in 'fitz/string.c,' which does not appropriately handle cases where a string might be absent. As a result, potential attackers could exploit this flaw to execute unexpected behaviors, potentially leading to data disclosure or integrity issues. Users are encouraged to upgrade to the latest version to mitigate risks associated with this vulnerability.