---
id: CVE-2026-7233
title: Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds
summary: >-
  A vulnerability was determined in Artifex MuPDF. The impacted element is the
  function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF
  Index Handler. This manipulation causes out-of-bounds read. The attack can
  only be…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-125
  - CWE-119
vendor: Artifex
product: MuPDF
affected:
  - MuPDF 1.24.0
  - MuPDF 1.24.1
  - MuPDF 1.24.2
  - MuPDF 1.24.3
  - MuPDF 1.24.4
  - MuPDF 1.24.5
  - MuPDF 1.24.6
  - MuPDF 1.24.7
  - MuPDF 1.24.8
  - MuPDF 1.24.9
  - MuPDF 1.24.10
  - MuPDF 1.24.11
  - MuPDF 1.25.0
  - MuPDF 1.25.1
  - MuPDF 1.25.2
  - MuPDF 1.25.3
  - MuPDF 1.25.4
  - MuPDF 1.25.5
  - MuPDF 1.25.6
  - MuPDF 1.26.0
  - MuPDF 1.26.1
  - MuPDF 1.26.2
  - MuPDF 1.26.3
  - MuPDF 1.26.4
  - MuPDF 1.26.5
  - MuPDF 1.26.6
  - MuPDF 1.26.7
  - MuPDF 1.26.8
  - MuPDF 1.26.9
  - MuPDF 1.26.10
  - MuPDF 1.26.11
  - MuPDF 1.26.12
  - MuPDF 1.27.0
  - MuPDF 1.27.1
  - MuPDF 1.27.2
  - MuPDF 1.28.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-29T15:14:06.670638Z'
exploitAvailable: true
published: '2026-04-28'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T07:27:29.629Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-7233'
references:
  - url: 'https://vuldb.com/vuln/359840'
    label: >-
      VDB-359840 | Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids
      out-of-bounds
  - url: 'https://vuldb.com/vuln/359840/cti'
    label: 'VDB-359840 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-7233'
    label: CVE-2026-7233 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/802590'
    label: 'Submit #802590 | Artifex MuPDF 1.28 Out-of-Bounds Read'
  - url: 'https://bugs.ghostscript.com/show_bug.cgi?id=709328'
  - url: 'https://github.com/biniamf/pocs/tree/main/mupdf-cff-indexload-oobread'
  - url: 'https://artifex.com/'
tags:
  - cve.org
  - exploit-available
epss: 0.00238
epssPercentile: 0.1488
ingestedAt: '2026-11-05T18:28:50.699Z'
---

## Overview

A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.

## Affected

- `MuPDF 1.24.0`
- `MuPDF 1.24.1`
- `MuPDF 1.24.2`
- `MuPDF 1.24.3`
- `MuPDF 1.24.4`
- `MuPDF 1.24.5`
- `MuPDF 1.24.6`
- `MuPDF 1.24.7`
- `MuPDF 1.24.8`
- `MuPDF 1.24.9`
- `MuPDF 1.24.10`
- `MuPDF 1.24.11`
- `MuPDF 1.25.0`
- `MuPDF 1.25.1`
- `MuPDF 1.25.2`
- `MuPDF 1.25.3`
- `MuPDF 1.25.4`
- `MuPDF 1.25.5`
- `MuPDF 1.25.6`
- `MuPDF 1.26.0`
- `MuPDF 1.26.1`
- `MuPDF 1.26.2`
- `MuPDF 1.26.3`
- `MuPDF 1.26.4`
- `MuPDF 1.26.5`
- `MuPDF 1.26.6`
- `MuPDF 1.26.7`
- `MuPDF 1.26.8`
- `MuPDF 1.26.9`
- `MuPDF 1.26.10`
- `MuPDF 1.26.11`
- `MuPDF 1.26.12`
- `MuPDF 1.27.0`
- `MuPDF 1.27.1`
- `MuPDF 1.27.2`
- `MuPDF 1.28.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.