CVE-2025-71382

MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering

Published Jun 23, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.

Analysis

Technical impact

MuPDF versions earlier than 1.27.0-rc1 have a flaw in the EPUB CSS rendering engine where the function value_from_inheritable_property() recurses through the CSS property inheritance chain without an explicit depth limit. When an application processes an EPUB file that contains deeply nested HTML elements and inline CSS styles, this recursion can overflow the process stack, leading to a crash and disabling the host application. The flaw is counted as a stack exhaustion vulnerability (CWE‑674) and effectively results in a denial‑of‑service condition.

Affected Systems

ArtifexSoftware's MuPDF versions prior to 1.27.0-rc1 are affected. The issue manifests in any product that incorporates MuPDF for EPUB rendering, regardless of the 1.27.0-rc1 EPUB file introduces deeply nested HTML elements and inline CSS, the function value_from_inheritable_property() recurses through the inheritance chain without a depth limit, exhausting the process stack and causing the application to crash. This is a classic stack exhaustion vulnerability identified as CWE‑674. Its primary consequence is denial of service for any application that renders such an EPUB file.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity rating. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is present in MuPDF versions before 1.27.0-rc1 EPUB file to a vulnerable system or by provoking the rendering of such a file in the background. No additional exploitation prerequisites are required beyond the ability to provide or cause the processing of the malicious EPUB content.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ArtifexSoftware

mupdf

affected

Version	Status	Constraints
`0`	affected	< 1.27.0-rc1

Configuration 1 [-]

cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Artifexsoftware

Mupdf

Version	Status	Scheme	Platform
`[0,1.27.0-rc1)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade MuPDF to version 1.27.0-rc1 or later, which contains the patch for the recursion depth limit.
If an upgrade is not immediately possible, configure the application to reject EPUB files from untrusted sources by blocking or filtering their input before rendering.
Implement input validation that limits the depth of nested elements in EPUB files or strips problematic inline CSS to mitigate the risk of stack exhaustion.

Generated by OpenCVE AI on June 24, 2026 at 10:24 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.583% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://bugs.ghostscript.com/show_bug.cgi?id=708840
https://github.com/ArtifexSoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94e
https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0-rc1
https://www.vulncheck.com/advisories/mupdf-rc1-stack-exhaustion-dos-via-epub-css-rendering

History

Jul 14, 2026 10:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Artifex Artifex mupdf
CPEs		cpe:2.3:a:artifex:mupdf::::::::
Vendors & Products		Artifex Artifex mupdf

Jun 23, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Artifexsoftware Artifexsoftware mupdf
Vendors & Products		Artifexsoftware Artifexsoftware mupdf

Jun 23, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.
Title		MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering
Weaknesses		CWE-674
References		https://bugs.ghostscript.com/show_bug.cgi?id=708840 https://github.com/ArtifexSoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94e https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0-rc1 https://www.vulncheck.com/advisories/mupdf-rc1-stack-exhaustion-dos-via-epub-css-rendering
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`