CVE-2025-46206
📋 TL;DR
This vulnerability allows remote attackers to cause denial of service in Artifex mupdf by exploiting infinite recursion in the strip_outline() function when processing malicious PDF files with cyclic /Next references. It affects users of mupdf versions 1.25.5 and 1.25.6 who process untrusted PDF files, particularly through the mutool clean utility.
💻 Affected Systems
- Artifex mupdf
- mutool utility
📦 What is this software?
Mupdf by Artifex
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of mupdf/mutool processes, potentially causing system resource exhaustion and affecting availability of PDF processing services.
Likely Case
Denial of service affecting mupdf/mutool processes when processing malicious PDF files, requiring process termination and restart.
If Mitigated
Limited impact with proper input validation and process isolation, though PDF processing may still fail.
🎯 Exploit Status
Proof of concept available on GitHub, requires user or system to process a crafted PDF file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 0ec7e4d2201bb6df217e01c17396d36297abf9ac and later versions
Vendor Advisory: https://bugs.ghostscript.com/show_bug.cgi?id=708521
Restart Required: No
Instructions:
1. Update mupdf to latest version from official repository. 2. Apply patch from commit 0ec7e4d2201bb6df217e01c17396d36297abf9ac. 3. Recompile if using source distribution.
🔧 Temporary Workarounds
Input validation for PDF files
allImplement PDF file validation before processing with mupdf/mutool
Process isolation
allRun mupdf/mutool in isolated containers or with resource limits
docker run --memory=512m --cpus=1 your_mupdf_container
🧯 If You Can't Patch
- Implement strict PDF file source validation and only process trusted PDFs
- Use alternative PDF processing tools for untrusted PDFs
🔍 How to Verify
Check if Vulnerable:
Check mupdf version and test with known malicious PDF sample from GitHub repositoryCheck Version:
mutool --versionVerify Fix Applied:
Test with same malicious PDF and verify no infinite recursion occurs📡 Detection & Monitoring
Log Indicators:
- High CPU usage by mupdf processes
- Process termination due to resource exhaustion
- Repeated mutool clean failures
Network Indicators:
- PDF file downloads followed by high resource usage
SIEM Query:
ProcessName="mutool" AND (CPUUsage>90 OR MemoryUsage>90)