A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
CVE-2026-7233
CVSS base score
3.3 (v3.1)
Severity
LOW
Attack vector
Local
Weakness
CWE-119, CWE-125
Last modified
November 1, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
artifex mupdf
References
- artifex.com Product
- bugs.ghostscript.com Exploit, Mitigation, Third Party Advisory
- github.com Exploit
- vuldb.com
- vuldb.com Exploit, Mitigation, Third Party Advisory
- vuldb.com Exploit, Mitigation, Third Party Advisory
- vuldb.com Permissions Required, VDB Entry
- bugs.ghostscript.com Exploit, Mitigation, Third Party Advisory
- vuldb.com Exploit, Mitigation, Third Party Advisory