CVE-2026-92413Medium· 4.3▾ TwilightPoC availableA flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation ca…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
Exploit / PoC code exists
0.4% → 0.6%
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112036Medium· 4.3Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
CVE-2026-103226Medium· 6.3A vulnerability was identified in Artifex Ghostscript up to 10.07.0
CVE-2026-100895Medium· 5.3A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1
CVE-2026-100890Medium· 5.3A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2
CVE-2026-93312Medium· 4.3A flaw has been found in Freedesktop Poppler 26.07.0
CVE-2026-91780Low· 3.3A weakness has been identified in GNU Binutils 2.47