Nixpkgs security tracker

Permalink CVE-2026-92413

2.1 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 11 hours ago Activity log

Created suggestion 11 hours ago

Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference

A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.

References

VDB-405593 | Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference technical-descriptionvdb-entry
VDB-405593 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
CVE-2026-92413 | CVE Analysis and Report third-party-advisory
Submit #940975 | Artifex Software MuPDF mutool commit b6d17493700c621c0e70036980a6ebd06d2202c9 NULL pointer dereference third-party-advisory
https://bugs.ghostscript.com/show_bug.cgi?id=709610 issue-tracking
https://bugs.ghostscript.com/attachment.cgi?id=28434 exploit
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=3df1e30f9d7b… patch
https://artifex.com/ product

Affected products

MuPDF

==b6d17493700c621c0e70036980a6ebd06d2202c9

Matching in nixpkgs

pkgs.mupdf

Lightweight PDF, XPS, and E-book viewer and toolkit written in portable C

nixos-unstable 1.27.2
- nixpkgs-unstable 1.27.2
- nixos-unstable-small 1.27.2
nixos-26.05 1.27.2
- nixos-26.05-small 1.27.2
- nixpkgs-26.05-darwin 1.27.2

pkgs.mupdf-headless

Lightweight PDF, XPS, and E-book viewer and toolkit written in portable C

nixos-unstable 1.27.2
- nixpkgs-unstable 1.27.2
- nixos-unstable-small 1.27.2
nixos-26.05 1.27.2
- nixos-26.05-small 1.27.2
- nixpkgs-26.05-darwin 1.27.2

pkgs.python313Packages.pymupdf

Python bindings for MuPDF's rendering library

nixos-unstable 1.27.2.3
- nixpkgs-unstable 1.27.2.3
- nixos-unstable-small 1.27.2.3
nixos-26.05 1.27.2.3
- nixos-26.05-small 1.27.2.3
- nixpkgs-26.05-darwin 1.27.2.3

pkgs.python314Packages.pymupdf

Python bindings for MuPDF's rendering library

nixos-unstable 1.27.2.3
- nixpkgs-unstable 1.27.2.3
- nixos-unstable-small 1.27.2.3
nixos-26.05 1.27.2.3
- nixos-26.05-small 1.27.2.3
- nixpkgs-26.05-darwin 1.27.2.3

pkgs.python313Packages.pymupdf4llm

PyMuPDF Utilities for LLM/RAG - converts PDF pages to Markdown format for Retrieval-Augmented Generation

nixos-unstable 0.3.4
- nixpkgs-unstable 0.3.4
- nixos-unstable-small 0.3.4
nixos-26.05 0.3.4
- nixos-26.05-small 0.3.4
- nixpkgs-26.05-darwin 0.3.4

pkgs.python314Packages.pymupdf4llm

PyMuPDF Utilities for LLM/RAG - converts PDF pages to Markdown format for Retrieval-Augmented Generation

nixos-unstable 0.3.4
- nixpkgs-unstable 0.3.4
- nixos-unstable-small 0.3.4
nixos-26.05 0.3.4
- nixos-26.05-small 0.3.4
- nixpkgs-26.05-darwin 0.3.4

pkgs.zathuraPkgs.zathura_pdf_mupdf

Zathura PDF plugin (mupdf)

nixos-unstable 2026.05.10
- nixpkgs-unstable 2026.05.10
- nixos-unstable-small 2026.05.10
nixos-26.05 2026.05.10
- nixos-26.05-small 2026.05.10
- nixpkgs-26.05-darwin 2026.05.10

pkgs.python313Packages.pymupdf-fonts

Collection of optional fonts for PyMuPDF

nixos-unstable 1.0.5
- nixpkgs-unstable 1.0.5
- nixos-unstable-small 1.0.5
nixos-26.05 1.0.5
- nixos-26.05-small 1.0.5
- nixpkgs-26.05-darwin 1.0.5

pkgs.python314Packages.pymupdf-fonts

Collection of optional fonts for PyMuPDF

nixos-unstable 1.0.5
- nixpkgs-unstable 1.0.5
- nixos-unstable-small 1.0.5
nixos-26.05 1.0.5
- nixos-26.05-small 1.0.5
- nixpkgs-26.05-darwin 1.0.5

Package maintainers

@fpletz Franz Pletz <fpletz@fnordicwalking.de>
@sarahec Sarah Clark <seclark@nextquestion.net>
@ryota2357 Ryota Otsuki <contact@ryota2357.com>
@MithicSpirit MithicSpirit <rpc01234@gmail.com>

Permalink CVE-2026-7233

3.3 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Not Defined (X)
Report Confidence (RC): Reasonable (R)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 4 months, 2 weeks ago Activity log

Created suggestion 4 months, 2 weeks ago

Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds

A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.