Vulnerability in Artifex Mupdf
CVE-2025-15569
A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. T…
EPSS: 0.000 (3.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C.
Affected products
- Artifex Mupdf — versions 1.26.0, 1.26.1, 1.26.2
Weakness classification (CWE)
References
- VDB-344924 | Artifex MuPDF win_main.c get_system_dpi uncontrolled search path (vdb-entry, technical-description)
- VDB-344924 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
- Submit #750978 | Artifex Software MuPDF 1.26.2 Uncontrolled Search Path (third-party-advisory)
- cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/ (patch)
- casper.mupdf.com/downloads/archive/mupdf-1.26.2-windows.zip (patch)
- artifex.com/ (product)
Frequently asked questions
- What is CVE-2025-15569?
- CVE-2025-15569 is a high-severity vulnerability in Artifex Mupdf, classified under Uncontrolled Search Path Element. CVSS score: 7.0/10. Published 2026-02-10.
- How severe is CVE-2025-15569?
- High severity. CVSS v3 base score is 7.0 out of 10.