CVE-2025-71382 | Medium | 6.5 | 2026-06-23 | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of ser… |
CVE-2026-7233 | Low | 3.3 | 2026-04-28 | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the compo… |
CVE-2026-40505 | Low | 3.3 | 2026-04-16 | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metada… |
CVE-2025-15569 | High | 7.0 | 2026-02-10 | A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This m… |
CVE-2026-25556 | High | 7.5 | 2026-02-06 | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list ren… |
CVE-2025-55780 | High | 7.5 | 2025-09-23 | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the fu… |
CVE-2025-59801 | Medium | 4.3 | 2025-09-22 | In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked. |
CVE-2025-59800 | Medium | 4.3 | 2025-09-22 | In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8. |
CVE-2025-59799 | Medium | 4.3 | 2025-09-22 | Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value. |
CVE-2025-59798 | Medium | 4.3 | 2025-09-22 | Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c. |
CVE-2025-46206 | Medium | 6.5 | 2025-08-04 | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When pr… |
CVE-2025-7462 | Medium | 4.3 | 2025-07-12 | A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function… |
CVE-2025-48708 | Medium | 4.0 | 2025-05-23 | gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document incl… |
CVE-2025-46646 | Medium | 4.5 | 2025-04-26 | In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix f… |
CVE-2025-27837 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for… |
CVE-2025-27836 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c. |
CVE-2025-27835 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c. |
CVE-2025-27834 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c. |
CVE-2025-27833 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c. |
CVE-2025-27832 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c. |
CVE-2025-27831 | Critical | 9.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/d… |
CVE-2025-27830 | High | 7.8 | 2025-03-25 | An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and… |
CVE-2024-46657 | Medium | 5.5 | 2024-12-10 | Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. This vulnerability allows attackers to cau… |
CVE-2024-46956 | High | 7.8 | 2024-11-10 | An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution. |
CVE-2024-46955 | Medium | 5.5 | 2024-11-10 | An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space. |
CVE-2024-46954 | High | 7.8 | 2024-11-10 | An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../ directory travers… |
CVE-2024-46953 | High | 7.8 | 2024-11-10 | An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output f… |
CVE-2024-46952 | High | 7.8 | 2024-11-10 | An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during handling of a PDF XRef stream (related to W… |
CVE-2024-46951 | High | 7.8 | 2024-11-10 | An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitra… |
CVE-2024-33871 | High | 8.8 | 2024-07-03 | An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable… |
CVE-2024-33870 | Medium | 6.3 | 2024-07-03 | An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current di… |
CVE-2024-33869 | Medium | 5.3 | 2024-07-03 | An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of pa… |
CVE-2024-29511 | High | 7.5 | 2024-07-03 | Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error me… |
CVE-2024-29510 | Medium | 6.3 | 2024-07-03 | Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device. |
CVE-2024-29507 | Medium | 5.4 | 2024-07-03 | Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters. |
CVE-2024-29509 | High | 8.8 | 2024-07-03 | Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle. |
CVE-2024-29508 | Low | 3.3 | 2024-07-03 | Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc. |
CVE-2024-29506 | High | 8.8 | 2024-07-03 | Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name. |
CVE-2023-52722 | Medium | 5.5 | 2024-04-28 | An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard. |
CVE-2024-24259 | High | 7.5 | 2024-02-05 | freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function. |
CVE-2024-24258 | High | 7.5 | 2024-02-05 | freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function. |
CVE-2020-36773 | Critical | 9.8 | 2024-02-04 | Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in… |
CVE-2023-51107 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute_color() of jquant2.c. NOTE: this is dispute… |
CVE-2023-51106 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function pnm_binary_read_image() of load-pnm.c when fz_colorspace_n… |
CVE-2023-51105 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function bmp_decompress_rle4() of load-bmp.c. |
CVE-2023-51104 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm_binary_read_image() of load-pnm.c when span eq… |
CVE-2023-51103 | High | 7.5 | 2023-12-26 | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in the function fz_new_pixmap_from_float_data() of pixmap.c. |
CVE-2023-46751 | High | 7.5 | 2023-12-06 | An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the applicatio… |
CVE-2023-46361 | Medium | 6.5 | 2023-10-31 | Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. |
CVE-2023-31794 | Medium | 5.5 | 2023-10-31 | MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2023-43115 | High | 8.8 | 2023-09-18 | In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the… |
CVE-2023-4042 | Medium | 5.5 | 2023-08-23 | A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue o… |
CVE-2020-26683 | Medium | 5.5 | 2023-08-22 | A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF 1.17.0 allows attackers to obtain sensitive information. |
CVE-2020-21896 | Medium | 5.5 | 2023-08-22 | A Use After Free vulnerability in svg_dev_text_span_as_paths_defs function in source/fitz/svg-device.c in Artifex Software MuPDF 1.16.0 allows remote attackers… |
CVE-2020-21890 | High | 7.8 | 2023-08-22 | Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of service… |
CVE-2020-21710 | Medium | 5.5 | 2023-08-22 | A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a denial of service via… |
CVE-2023-38560 | Medium | 5.5 | 2023-08-01 | An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service v… |
CVE-2023-38559 | Medium | 5.5 | 2023-08-01 | A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of ser… |
CVE-2021-33796 | Critical | 10.0 | 2023-07-07 | In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.
|
CVE-2023-36664 | High | 7.8 | 2023-06-25 | Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). |
CVE-2021-33797 | Critical | 9.8 | 2023-04-17 | Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when js_strtod() reads in floating point exponent, which le… |
CVE-2023-28879 | Critical | 9.8 | 2023-03-31 | In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp… |
CVE-2022-44789 | High | 8.8 | 2022-11-23 | A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through me… |
CVE-2021-4216 | Medium | 5.5 | 2022-08-26 | A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream. |
CVE-2020-27792 | High | 7.1 | 2022-08-19 | A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to tri… |
CVE-2022-2085 | Medium | 5.5 | 2022-06-16 | A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buf… |
CVE-2022-30975 | Medium | 5.5 | 2022-05-18 | In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated by mujs-pp. |
CVE-2022-30974 | Medium | 5.5 | 2022-05-18 | compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-2019-11413. |
CVE-2019-25059 | High | 7.8 | 2022-04-25 | Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. |
CVE-2022-1350 | Medium | 4.3 | 2022-04-14 | A vulnerability classified as problematic was found in GhostPCL 9.55.0. This vulnerability affects the function chunk_free_object of the file gsmchunk.c. The m… |
CVE-2021-3781 | Critical | 9.9 | 2022-02-16 | A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This… |
CVE-2021-45005 | Critical | 9.8 | 2022-02-14 | Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements. |
CVE-2021-45949 | Medium | 5.5 | 2022-01-01 | Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp). |
CVE-2021-45944 | Medium | 5.5 | 2022-01-01 | Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp). |
CVE-2021-37220 | Medium | 5.5 | 2021-07-21 | MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consider the maximum key size of a hash table. This can, f… |
CVE-2020-19609 | Medium | 5.5 | 2021-07-21 | Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when parsing TIFF files allowing attackers to cause a denial… |
CVE-2020-22886 | High | 7.5 | 2021-07-13 | Buffer overflow vulnerability in function jsG_markobject in jsgc.c in mujs before 1.0.8, allows remote attackers to cause a denial of service. |
CVE-2020-22885 | High | 7.5 | 2021-07-13 | Buffer overflow vulnerability in mujs before 1.0.8 due to recursion in the GC scanning phase, allows remote attackers to cause a denial of service. |
CVE-2021-3407 | Medium | 5.5 | 2021-02-23 | A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other potential consequences. |
CVE-2020-16600 | High | 7.8 | 2020-12-09 | A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.17.0-rc1 and earlier when a valid page was followed by a page with invalid pixm… |
CVE-2020-26519 | Medium | 5.5 | 2020-10-02 | Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service. |
CVE-2020-14373 | Medium | 5.5 | 2020-09-03 | A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker could supply a specially crafted PDF file to cause a de… |
CVE-2020-24343 | High | 7.8 | 2020-08-13 | Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c. |
CVE-2020-17538 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to… |
CVE-2020-16310 | Medium | 5.5 | 2020-08-13 | A division by zero vulnerability in dot24_print_page() in devices/gdevdm24.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial o… |
CVE-2020-16309 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in lxm5700m_print_page() in devices/gdevlxm.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-16308 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in p_print_image() in devices/gdevcdj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of ser… |
CVE-2020-16307 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause… |
CVE-2020-16306 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in devices/gdevtsep.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via… |
CVE-2020-16305 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in pcx_write_rle() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a deni… |
CVE-2020-16304 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in image_render_color_thresh() in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to es… |
CVE-2020-16303 | High | 7.8 | 2020-08-13 | A use-after-free vulnerability in xps_finish_image_path() in devices/vector/gdevxps.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalat… |
CVE-2020-16302 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privi… |
CVE-2020-16301 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-16300 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in tiff12_print_page() in devices/gdevtfnx.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial o… |
CVE-2020-16299 | Medium | 5.5 | 2020-08-13 | A Division by Zero vulnerability in bj10v_print_page() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a… |
CVE-2020-16298 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in mj_color_correct() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a d… |
CVE-2020-16297 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in FloydSteinbergDitheringC() in contrib/gdevbjca.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to… |
CVE-2020-16296 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in GetNumWrongData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker t… |
CVE-2020-16295 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in clj_media_size() in devices/gdevclj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a den… |