Patch & vulnerability status
mutool 1.23.0
Latest tracked version 1.23.0. Release status, tracked CVEs, and automated cross-platform patching for mutool.
| Platform | Latest version | CVEs tracked | Last checked |
|---|---|---|---|
| Windows | 1.23.0 | 45 | 2024-12-06 |
Known vulnerabilities (CVEs) in mutool
Lavawall tracks 45 published CVEs affecting mutool, and deploys the versions that fix them automatically across your fleet.
| CVE | Published | Severity | Details | Vector |
|---|---|---|---|---|
| CVE-2026-7233 | 2026-04-28 07:16:04 | LOW (2) | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet. | LOCAL |
| CVE-2026-25556 | 2026-02-06 17:16:27 | MEDIUM (6) | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes. | NETWORK |
| CVE-2025-46206 | 2025-08-04 18:15:35 | MEDIUM (7) | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion | NETWORK |
| CVE-2024-46657 | 2024-12-10 17:15:10 | MEDIUM (6) | Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. | LOCAL |
| CVE-2023-51107 | 2023-12-26 15:15:09 | HIGH (8) | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute_color() of jquant2.c. NOTE: this is disputed by the supplier because there was not reasonable evidence to determine the existence of a vulnerability or identify the affected product. | NETWORK |
| CVE-2023-51105 | 2023-12-26 15:15:09 | HIGH (8) | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function bmp_decompress_rle4() of load-bmp.c. | NETWORK |
| CVE-2023-51104 | 2023-12-26 15:15:09 | HIGH (8) | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm_binary_read_image() of load-pnm.c when span equals zero. | NETWORK |
| CVE-2023-51103 | 2023-12-26 15:15:09 | HIGH (8) | A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in the function fz_new_pixmap_from_float_data() of pixmap.c. | NETWORK |
| CVE-2020-26683 | 2023-08-22 19:16:20 | MEDIUM (6) | A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF 1.17.0 allows attackers to obtain sensitive information. | LOCAL |
| CVE-2020-26519 | 2020-10-02 06:15:12 | MEDIUM (6) | Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service. | LOCAL |
| CVE-2020-21896 | 2023-08-22 19:16:19 | MEDIUM (6) | A Use After Free vulnerability in svg_dev_text_span_as_paths_defs function in source/fitz/svg-device.c in Artifex Software MuPDF 1.16.0 allows remote attackers to cause a denial of service via opening of a crafted PDF file. | LOCAL |
| CVE-2020-19609 | 2021-07-21 15:15:13 | MEDIUM (6) | Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when parsing TIFF files allowing attackers to cause a denial of service. | LOCAL |
| CVE-2020-16600 | 2020-12-09 21:15:15 | HIGH (8) | A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.17.0-rc1 and earlier when a valid page was followed by a page with invalid pixmap dimensions, causing bander - a static - to point to previously freed memory instead of a newband_writer. | LOCAL |
| CVE-2019-7321 | 2019-06-13 18:29:01 | HIGH (8) | Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allows an attacker to execute arbitrary code. | NETWORK |
| CVE-2019-6131 | 2019-01-11 05:29:02 | MEDIUM (4) | svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element, and svg_run_use, as demonstrated by mutool. | NETWORK |
| CVE-2019-6130 | 2019-01-11 05:29:02 | MEDIUM (4) | Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. This is related to page-number mishandling in cbz/mucbz.c, cbz/muimg.c, and svg/svg-doc.c. | NETWORK |
| CVE-2019-14975 | 2019-08-14 13:15:11 | MEDIUM (6) | Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string. | NETWORK |
| CVE-2019-13290 | 2019-07-04 22:15:11 | MEDIUM (7) | Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node. | NETWORK |
| CVE-2018-6544 | 2018-02-02 09:29:01 | MEDIUM (4) | pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. | NETWORK |
| CVE-2018-6192 | 2018-01-24 21:29:00 | MEDIUM (4) | In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file. | NETWORK |
| CVE-2018-6187 | 2018-01-24 10:29:01 | MEDIUM (4) | In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf-write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. | NETWORK |
| CVE-2018-19882 | 2018-12-06 00:29:00 | MEDIUM (4) | In Artifex MuPDF 1.14.0, the svg_run_image function in svg/svg-run.c allows remote attackers to cause a denial of service (href_att NULL pointer dereference and application crash) via a crafted svg file, as demonstrated by mupdf-gl. | NETWORK |
| CVE-2018-19881 | 2018-12-06 00:29:00 | MEDIUM (4) | In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from excessive stack consumption) via a crafted svg file, as demonstrated by mupdf-gl. | NETWORK |
| CVE-2018-19777 | 2018-11-30 10:29:00 | MEDIUM (4) | In Artifex MuPDF 1.14.0, there is an infinite loop in the function svg_dev_end_tile in fitz/svg-device.c, as demonstrated by mutool. | NETWORK |
| CVE-2018-18662 | 2018-10-26 14:29:03 | MEDIUM (4) | There is an out-of-bounds read in fz_run_t3_glyph in fitz/font.c in Artifex MuPDF 1.14.0, as demonstrated by mutool. | NETWORK |
| CVE-2018-16648 | 2018-09-06 23:29:02 | MEDIUM (4) | In Artifex MuPDF 1.13.0, the fz_append_byte function in fitz/buffer.c allows remote attackers to cause a denial of service (segmentation fault) via a crafted pdf file. This is caused by a pdf/pdf-device.c pdf_dev_alpha array-index underflow. | NETWORK |
| CVE-2018-16647 | 2018-09-06 23:29:02 | MEDIUM (4) | In Artifex MuPDF 1.13.0, the pdf_get_xref_entry function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation fault in fz_write_data in fitz/output.c) via a crafted pdf file. | NETWORK |
| CVE-2018-100005 | 2018-02-09 23:29:02 | MEDIUM (7) | Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF. | NETWORK |
| CVE-2018-100004 | 2018-05-24 13:29:01 | MEDIUM (4) | In Artifex MuPDF 1.12.0 and earlier, multiple use of uninitialized value bugs in the PDF parser could allow an attacker to cause a denial of service (crash) or influence program flow via a crafted file. | NETWORK |
| CVE-2018-100003 | 2018-05-24 13:29:01 | MEDIUM (7) | In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service (assert crash) via a crafted file. | NETWORK |
| CVE-2017-7264 | 2017-03-26 05:59:00 | MEDIUM (5) | Use-after-free vulnerability in the fz_subsample_pixmap function in fitz/pixmap.c in Artifex MuPDF 1.10a allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted document. | NETWORK |
| CVE-2017-6060 | 2017-03-15 14:59:01 | HIGH (8) | Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image. | LOCAL |
| CVE-2017-5991 | 2017-02-15 06:59:01 | HIGH (8) | An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function in pdf-op-run.c encounters a NULL pointer dereference during a Fitz fz_paint_pixmap_with_mask painting operation. Versions 1.11 and later are unaffected. | NETWORK |
| CVE-2017-17866 | 2017-12-27 17:08:21 | MEDIUM (7) | pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document. | NETWORK |
| CVE-2017-17858 | 2018-01-22 15:29:00 | MEDIUM (7) | Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted. | NETWORK |
| CVE-2017-15587 | 2017-10-18 08:29:00 | MEDIUM (7) | An integer overflow was discovered in pdf_read_new_xref_section in pdf/pdf-xref.c in Artifex MuPDF 1.11. | NETWORK |
| CVE-2017-15369 | 2017-10-16 01:29:01 | MEDIUM (7) | The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before 2017-09-25 mishandles a certain case where a variable may reside in a register, which allows remote attackers to cause a denial of service (Fitz fz_drop_imp use-after-free and application crash) or possibly have unspecified other impact via a crafted PDF document. | NETWORK |
| CVE-2017-14687 | 2017-09-22 06:29:00 | MEDIUM (7) | Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016cb4f" on Windows. This occurs because of mishandling of XML tag name comparisons. | NETWORK |
| CVE-2017-14686 | 2017-09-22 06:29:00 | MEDIUM (7) | Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x000000000000001d" on Windows. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. | NETWORK |
| CVE-2017-14685 | 2017-09-22 06:29:00 | MEDIUM (7) | Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. | NETWORK |
| CVE-2016-8729 | 2018-04-24 19:29:00 | HIGH (8) | An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corruption and potential code execution. An attacker can specially craft a PDF and send to the victim to trigger this vulnerability. | LOCAL |
| CVE-2016-10247 | 2017-03-16 14:59:00 | MEDIUM (6) | Buffer overflow in the my_getline function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. | LOCAL |
| CVE-2016-10246 | 2017-03-16 14:59:00 | MEDIUM (6) | Buffer overflow in the main function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. | LOCAL |
| CVE-2016-10221 | 2017-04-03 05:59:00 | MEDIUM (4) | The count_entries function in pdf-layer.c in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted PDF document. | NETWORK |
| CVE-2011-0341 | 2011-05-13 17:05:42 | HIGH (9) | Stack-based buffer overflow in the pdfmoz_onmouse function in apps/mozilla/moz_main.c in the MuPDF plug-in 2008.09.02 for Firefox allows remote attackers to execute arbitrary code via a crafted web site. | NETWORK |
Why keeping mutool patched matters
Unpatched third-party applications are one of the most common ways attackers get in: 57% of breached MSP clients and 32% of ransomware cases trace back to a missing patch. Every mutool release that fixes a security bug is public, so attackers see it too, and an out-of-date install becomes a documented way in. Tracking the installed version on every machine and closing the gap quickly is what turns a disclosed CVE into a non-event.
How Lavawall® patches mutool
Lavawall® watches mutool releases and CVEs continuously, ranks each update by risk, and deploys it across your whole fleet, Windows, macOS, and Linux, from a single agent, independently of your RMM. You get one place to see which machines are behind on mutool, one policy to bring them current, and timestamped evidence for audits.
Frequently asked questions
What is the latest version of mutool?
Lavawall tracks mutool at version 1.23.0 (last checked 2024-12-06). New releases are monitored continuously and can be deployed automatically across your fleet.
Lavawall tracks mutool at version 1.23.0 (last checked 2024-12-06). New releases are monitored continuously and can be deployed automatically across your fleet.
Does mutool have known security vulnerabilities (CVEs)?
Lavawall tracks 45 CVEs for mutool and remediates them automatically as part of patching.
Lavawall tracks 45 CVEs for mutool and remediates them automatically as part of patching.
How do I patch mutool automatically?
Deploy the Lavawall® agent and mutool updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Deploy the Lavawall® agent and mutool updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Lavawall® monitors releases and CVEs for mutool through public information and proprietary statistical analysis, and can patch it automatically across your fleet.