CVE-2026-92413

Name	CVE-2026-92413
Description	A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mupdf (PTS)	bookworm, bookworm (security)	1.21.1+ds2-1+deb12u1	fixed
	trixie (security), trixie	1.25.1+ds1-6+deb13u1	fixed
	forky, sid	1.28.2+ds1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mupdf	source	(unstable)	(not affected)

Notes

- mupdf <not-affected> (vulnerable code not present)
https://bugs.ghostscript.com/show_bug.cgi?id=709610
Introduced with: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=f3cf84aaac3c0a59854edc5af7fdad754577b97b
Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=3df1e30f9d7b77260e13bd0dbe1928ddeba8386e