Integer overflow in Artifex Software Inc. *Pymupdf* Mupdf
CVE-2026-3308
An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code execution.
Vulnerability class: Integer Overflow
EPSS: 0.002 (11.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Artifex Software Inc. *Pymupdf* Mupdf — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-3308?
- CVE-2026-3308 is a high-severity vulnerability in Artifex Software Inc. *Pymupdf* Mupdf, classified under Integer Overflow or Wraparound. CVSS score: 7.8/10. Published 2026-03-31.
- How severe is CVE-2026-3308?
- High severity. CVSS v3 base score is 7.8 out of 10.