Integer Overflow Vulnerability in MuPDF from Artifex Software

CVE-2026-3308

What is CVE-2026-3308?

An integer overflow vulnerability exists in the 'pdf-image.c' file of MuPDF, specifically in version 1.27.0. The vulnerability arises when the 'pdf_load_image_imp' function processes a specially crafted PDF file. This flaw enables an attacker to induce an integer overflow, leading to a heap out-of-bounds write. When successfully exploited, it could allow the execution of arbitrary code, posing significant security risks to affected systems.

References