CVE-2017-5991: Artifex Mupdf

High severity, CVSS 7.5. EPSS: 15.2% chance of exploitation in the next 30 days.

An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function in pdf-op-run.c encounters a NULL pointer dereference during a Fitz fz_paint_pixmap_with_mask painting operation. Versions 1.11 and later are unaffected.

Affected products

• Artifex Mupdf: before 1.11 (fixed in 1.11)
• Debian Debian Linux: version 8.0 only; version 9.0 only

Published 2017-02-15. Last modified 2026-06-17.