Null Pointer Dereference in MuPDF EPUB Rendering
CVE-2025-55780
7.5HIGH
Key Information:
- Vendor
Artifex Software
- Status
- Vendor
- CVE Published:
- 23 September 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-55780?
A flaw exists within the MuPDF library, specifically in version 1.26.4 where a null pointer dereference can occur in the function responsible for rendering malformed EPUB documents. When handling a FLOW_WORD node, the function fails to authenticate the validity of a pointer before accessing it. This oversight can lead to application crashes, particularly if the rendering process encounters an error or results in a truncated node chain.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.