CVE-2017-14686: Artifex Mupdf

High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days.

Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x000000000000001d" on Windows. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers.

Affected products

• Artifex Mupdf: version 1.11 only

Published 2017-09-22. Last modified 2026-06-17.