artifex has 7 CVEs on record between 2022 and 2026. 3 were published in the last 90 days. The median CVSS is 5.5 (medium). None have a confirmed exploitation report. Most affected products: Ghostscript (4), MuPDF (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 1
Worst active — by depth score
CVE-2023-36664High· 7.8Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).56CVE-2026-112036Medium· 4.3Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free36CVE-2026-92413Medium· 4.3A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c936CVE-2025-71382Medium· 6.5MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elem…36CVE-2026-103226Medium· 6.3A vulnerability was identified in Artifex Ghostscript up to 10.07.035
artifex vulnerabilities
CVEs affecting artifex, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-112036Medium· 4.3PoCArtifex MuPDF Signature Locking pdf-xref.c free_char_list double free
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may b…
CVE-2026-103226Medium· 6.3A vulnerability was identified in Artifex Ghostscript up to 10.07.0
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote e…
CVE-2026-92413Medium· 4.3PoCA flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation ca…
CVE-2025-71382Medium· 6.5MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elem…
MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elem…
CVE-2023-38559Medium· 5.5A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript
A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.
CVE-2023-36664High· 7.8PoCArtifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
CVE-2021-45949Medium· 5.5Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).