p PatchFirst

CVE-2025-15569

CVE-2025-15569 · Artifex MuPDF win_main.c get_system_dpi uncontrolled search path

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The exploitability is regarded as difficult. Upgrading to version 1.26.2 is sufficient to resolve this issue. Patch name: ebb125334eb007d64e579204af3c264aadf2e244. Upgrading the affected component is recommended.

CVSS 7.3 · High · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mupdf

    Versions
    • 1.26.0: Affected
    • 1.26.1: Affected
    • 1.26.2: Not affected

    Update to 1.26.2

  • mupdf Ubuntu:Pro:16.04:LTS

    Versions
    • 1.7-1
    • 1.7a-1
    • 1.7a-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:Pro:18.04:LTS

    Versions
    • 1.11+ds1-1.1
    • 1.11+ds1-2
    • 1.12.0+ds1-1
    • 1.12.0+ds1-1ubuntu0.1~esm1
    • 1.12.0+ds1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:Pro:20.04:LTS

    Versions
    • 1.15.0+ds1-1
    • 1.16.1+ds1-1ubuntu1
    • 1.16.1+ds1-1ubuntu1+esm1
    • 1.16.1+ds1-1ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:22.04:LTS

    Versions
    • 1.17.0+ds1-2
    • 1.19.0+ds1-1
    • 1.19.0+ds1-1build1
    • 1.19.0+ds1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:24.04:LTS

    Versions
    • 1.22.2+ds1-2
    • 1.22.2+ds1-2build1
    • 1.23.6+ds1-1
    • 1.23.7+ds1-1
    • 1.23.10+ds1-1
    • 1.23.10+ds1-1build1
    • 1.23.10+ds1-1build2
    • 1.23.10+ds1-1build3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:25.10

    Versions
    • 1.25.1+ds1-5build2
    • 1.25.1+ds1-6
    • 1.25.1+ds1-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →