Bug 2535820

Summary:	CVE-2026-92413 mupdf: Artifex MuPDF: Denial of Service via null pointer dereference in PDF Xref Loading [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Vladimir Vasilev <vvasilev>
Component:	mupdf	Assignee:	Michael J Gruber <mjg>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	lizhenbo, mjg
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["6eca110f-2302-498b-8eae-246ff19fa52c"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-09-21 12:22:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2535574

Description Vladimir Vasilev 2026-09-17 06:44:58 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.

Comment 1 Michael J Gruber 2026-09-17 09:10:01 UTC

The analysis looks flawed.

the affected code has been introduced as recently as f3cf84aaac3c0a59854edc5af7fdad754577b97b which no released mupdf version carries. If there is a different code path triggering this, please specify the affected versions.

Comment 2 Michael J Gruber 2026-09-17 11:46:16 UTC

Indeed, the analysis is flawed in two directions and this dangerous: the flaw has been found exactly in b6d17493700c621c0e70036980a6ebd06d2202c9, and later "versions" *are affected as well* as long as they do not contain the fix from 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e.

In contrast, "versions" before f3cf84aaac3c0a59854edc5af7fdad754577b97b do not contain the code which needed a fix (nor the fix, of course). In particular, no released mupdf has that code.

Comment 3 Vladimir Vasilev 2026-09-21 12:18:53 UTC

Thanks for the review. I verified the upstream source and release ancestry:

- f3cf84aaac3c0a59854edc5af7fdad754577b97b introduced the external-stream path in pdf_open_filter().
- 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e changes its failure handling to throw.
- The introduction commit is not present in upstream release tags. I also checked the pdf-stream.c source in the relevant 1.28.x releases; it does not contain that external-stream code.
- Fedora Rawhide packages 1.28.2, with no downstream patch introducing this code.

Therefore no Fedora-shipped MuPDF build is affected. The original affected-version analysis was incorrect.

Let me know if you want me to close this as "not affected" or you will do it.