CVE-2026-7233Low· 3.3▾ TwilightPoC availableA vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 18.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
MuPDF 1.24.0MuPDF 1.24.1MuPDF 1.24.2MuPDF 1.24.3MuPDF 1.24.4MuPDF 1.24.5MuPDF 1.24.6MuPDF 1.24.7MuPDF 1.24.8MuPDF 1.24.9MuPDF 1.24.10MuPDF 1.24.11MuPDF 1.25.0MuPDF 1.25.1MuPDF 1.25.2MuPDF 1.25.3MuPDF 1.25.4MuPDF 1.25.5MuPDF 1.25.6MuPDF 1.26.0MuPDF 1.26.1MuPDF 1.26.2MuPDF 1.26.3MuPDF 1.26.4MuPDF 1.26.5MuPDF 1.26.6MuPDF 1.26.7MuPDF 1.26.8MuPDF 1.26.9MuPDF 1.26.10MuPDF 1.26.11MuPDF 1.26.12MuPDF 1.27.0MuPDF 1.27.1MuPDF 1.27.2MuPDF 1.28.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112036Medium· 4.3Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
CVE-2026-92413Medium· 4.3A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9
CVE-2026-103226Medium· 6.3A vulnerability was identified in Artifex Ghostscript up to 10.07.0
CVE-2025-11840Low· 3.3A weakness has been identified in GNU Binutils 2.45
CVE-2025-11413Low· 3.3A vulnerability was found in GNU Binutils 2.45
CVE-2025-11414Low· 3.3A vulnerability was determined in GNU Binutils 2.45