VulnerabilityModified
CVE-2018-1000039
In Artifex MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a crafted file.
MEDIUM 6.3EPSS 1.82%
Does this matter?
Lower severity and a low EPSS score (1.82%). Track it; it rarely justifies an emergency change on its own.
Description
In Artifex MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a crafted file.
- CVSS 3.1
- 6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- EPSS
- 1.82% probability · 79th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- artifex/mupdf
- Source
- cve@mitre.org
EPSS moved from 3.3% on 21 September 2026 to 1.8% on 27 October 2026.
References
- http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=4dcc6affe04368461310a21238f7e1871a752a05%3Bhp=8ec561d1bccc46e9db40a9f61310cd8b3763914e
- http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=71ceebcf56e682504da22c4035b39a2d451e8ffd%3Bhp=7f82c01523505052615492f8e220f4348ba46995
- http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=f597300439e62f5e921f0d7b1e880b5c1a1f1607%3Bhp=093fc3b098dc5fadef5d8ad4b225db9fb124758b
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5492Exploit, Issue Tracking, Patch, Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5513Exploit, Issue Tracking, Patch, Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5521Exploit, Issue Tracking, Patch, Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5604Exploit, Issue Tracking, Third Party Advisory
- https://bugs.ghostscript.com/show_bug.cgi?id=698883
- https://bugs.ghostscript.com/show_bug.cgi?id=698888
- https://bugs.ghostscript.com/show_bug.cgi?id=698891
- https://bugs.ghostscript.com/show_bug.cgi?id=698892
- https://bugs.ghostscript.com/show_bug.cgi?id=698901
- https://security.gentoo.org/glsa/201811-15Third Party Advisory
- http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=4dcc6affe04368461310a21238f7e1871a752a05%3Bhp=8ec561d1bccc46e9db40a9f61310cd8b3763914e
- http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=71ceebcf56e682504da22c4035b39a2d451e8ffd%3Bhp=7f82c01523505052615492f8e220f4348ba46995
- http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=f597300439e62f5e921f0d7b1e880b5c1a1f1607%3Bhp=093fc3b098dc5fadef5d8ad4b225db9fb124758b
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5492Exploit, Issue Tracking, Patch, Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5513Exploit, Issue Tracking, Patch, Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5521Exploit, Issue Tracking, Patch, Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5604Exploit, Issue Tracking, Third Party Advisory
- https://bugs.ghostscript.com/show_bug.cgi?id=698883
- https://bugs.ghostscript.com/show_bug.cgi?id=698888
- https://bugs.ghostscript.com/show_bug.cgi?id=698891
- https://bugs.ghostscript.com/show_bug.cgi?id=698892
- https://bugs.ghostscript.com/show_bug.cgi?id=698901
- https://security.gentoo.org/glsa/201811-15Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.