A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain.
https://bugs.ghostscript.com/show_bug.cgi?id=708720 So, this is fixed in upstream/master (1.27.x). I'm backporting the fix to 1.26.9 which is the version coming to f44+f43 currently, and I'll have to see about released branches (backport further or update). Note that I cannot verify the fix as the reproducer in the upstream bug is private. I'll go by upstream's verdict on this.