rpm package
opensuse/mupdf&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/mupdf&distro=openSUSE%20Leap%2016.0
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-25556 | Hig | 7.5 | < 1.27.2-bp160.1.1 | 1.27.2-bp160.1.1 | Feb 6, 2026 | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path | |
| CVE-2025-55780 | Hig | 7.5 | < 1.27.2-bp160.1.1 | 1.27.2-bp160.1.1 | Sep 23, 2025 | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing n |
- affected < 1.27.2-bp160.1.1fixed 1.27.2-bp160.1.1
MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path
- affected < 1.27.2-bp160.1.1fixed 1.27.2-bp160.1.1
A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing n