CVE-2025-46206

NameCVE-2025-46206
DescriptionAn issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1110482

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mupdf (PTS)bullseye1.17.0+ds1-2vulnerable
bullseye (security)1.17.0+ds1-2+deb11u1vulnerable
bookworm1.21.1+ds2-1vulnerable
forky, trixie1.25.1+ds1-6vulnerable
sid1.25.1+ds1-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mupdfsource(unstable)1.25.1+ds1-71110482

Notes

[trixie] - mupdf <no-dsa> (Minor issue)
[bookworm] - mupdf <no-dsa> (Minor issue)
[bullseye] - mupdf <postponed> (Minor issue; local DoS)
https://bugs.ghostscript.com/show_bug.cgi?id=708521
Introduced after: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=dde049432d9f28d29aa4be6730e67ebc28415ef3 (1.9-rc1)
Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0ec7e4d2201bb6df217e01c17396d36297abf9ac

Search for package or bug name: Reporting problems