Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-6544: Artifex MuPDF 1.12.0 can crash from malicious PDF

CVE-2018-6544 · published 8 years ago

Summary

The MuPDF document viewer version 1.12.0 can run out of internal error space when it processes a specially crafted PDF file. This can cause the program to stop working, which may affect users who open such files. Update to a newer version of MuPDF or apply the vendor's patch to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
artifex	mupdf	1.12.0 `cpe:2.3:a:artifex:mupdf:1.12.0:::::::*`
debian	debian_linux	8.0 9.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`

Original advisory text

pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of ser...

References

http://git.ghostscript.com/?p=mupdf.git%3Bh=26527eef77b3e51c2258c8e40845bfbc015e...
http://git.ghostscript.com/?p=mupdf.git%3Bh=b03def134988da8c800adac1a38a41a1f09a...
https://bugs.ghostscript.com/show_bug.cgi?id=698830 Issue Tracking Permissions Required Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=698965 Exploit Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/201811-15 Third Party Advisory
https://www.debian.org/security/2018/dsa-4152 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-674Uncontrolled Recursion

Timeline

Published2 Feb 2018

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-6544 · NVD

Track software like this

Free during beta