Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0916

NIXPKGS-2026-0916
published on
updated 2 weeks, 2 days ago by @LeSuisse Activity log
  • Created automatic suggestion
  • @LeSuisse ignored
    11 packages
    • python312Packages.pymupdf
    • python313Packages.pymupdf
    • python314Packages.pymupdf
    • python312Packages.pymupdf4llm
    • mupdf-headless
    • python313Packages.pymupdf4llm
    • python314Packages.pymupdf4llm
    • zathuraPkgs.zathura_pdf_mupdf
    • python312Packages.pymupdf-fonts
    • python313Packages.pymupdf-fonts
    • python314Packages.pymupdf-fonts
  • @LeSuisse restored package mupdf-headless
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
CVE-2026-3308

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code execution.

Affected products

MuPDF
  • =<1.27.0

Matching in nixpkgs

pkgs.mupdf

Lightweight PDF, XPS, and E-book viewer and toolkit written in portable C

Ignored packages (10)

Package maintainers

Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=a26f0142e7d390d4a82c6e5ae0e312e07cc4ec85