Log in Start free

Vulnerability · Published Feb 10, 2026 · Assigned by VulDB

CVE-2025-15569Artifex MuPDF win_main.c get_system_dpi uncontrolled search path

High 7.0

In plain English

A high-severity uncontrolled search path in MuPDF from Artifex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 96.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The exploitability is regarded as difficult. Upgrading to version 1.26.2 is sufficient to resolve this issue. Patch name: ebb125334eb007d64e579204af3c264aadf2e244. Upgrading the affected component is recommended.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSmupdfno fix listedUBUNTU-CVE-2025-15569
Ubuntu:24.04:LTSmupdfno fix listedUBUNTU-CVE-2025-15569
Ubuntu:25.10mupdfno fix listedUBUNTU-CVE-2025-15569

Affected products (as reported)

VendorProductVersions
Artifex MuPDF 1.26.01.26.1

Weakness: CWE-427, CWE-426 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C

References