An integer overflow occurs in the pdf_image.c component of MuPDF version 1.27.0 when processing a PDF image. The overflow allows data to be written beyond the intended heap buffer within the pdf_load_image_imp function, potentially corrupting adjacent memory and yielding an arbitrary code execution path for the process that has access to the MuPDF library. The weakness is classified as CWE‑190, integer overflow.

The vulnerability affects Artifex Software Inc.’s MuPDF (also known as PyMuPDF) at version 1.27.0. Systems that rely on this specific release to render or manipulate PDF documents are susceptible to the overflow; no other versions or products are listed as affected in the current advisory.

The CVSS score of 7.8 indicates high severity, while an EPSS score below 1% suggests a low short‑term exploitation probability. The vulnerability is not present in the CISA KEV catalog, meaning no widespread attacks have been reported. The attack likely requires delivery of a malicious PDF to a MuPDF instance, which can occur locally or during remote download; exploitation would need the vulnerable binary to run with sufficient privileges to compromise the system context.