CVE-2017-14685: Artifex Mupdf

High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded.

Affected products

• Artifex Mupdf: version 1.11 only

Published 2017-09-22. Last modified 2026-06-17.