Log in Start free

Vulnerability · Published Mar 31, 2026 · Assigned by certcc

CVE-2026-3308CVE-2026-3308

High 7.8

In plain English

A high-severity integer overflow in MuPDF from Artifex Software Inc. *PyMuPDF*. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 87.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mupdf1.21.1+ds2-1+deb12u1DEBIAN-CVE-2026-3308
Debian:13mupdf1.25.1+ds1-6+deb13u1DEBIAN-CVE-2026-3308
Debian:14mupdf1.27.0+ds1-4DEBIAN-CVE-2026-3308
Ubuntu:25.10mupdfno fix listedUBUNTU-CVE-2026-3308
Ubuntu:26.04:LTSmupdfno fix listedUBUNTU-CVE-2026-3308
Ubuntu:26.10mupdfno fix listedUBUNTU-CVE-2026-3308

Affected products (as reported)

VendorProductVersions
Artifex Software Inc. *PyMuPDF* MuPDF 0 – through 1.27.0

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References