CVE-2025-15569

EUVD-2025-207353

10.02.2026, 11:16

A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The exploitability is regarded as difficult. Upgrading to version 1.26.2 is sufficient to resolve this issue. Patch name: ebb125334eb007d64e579204af3c264aadf2e244. Upgrading the affected component is recommended.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulDB	CNA	7 HIGH	LOCAL	HIGH	LOW	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 1.85%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
artifex	mupdf	1.26.0	CNA
artifex	mupdf	1.26.1	CNA

Ubuntu Releases

Ubuntu Product

Codename

mupdf

bionic	ignored
focal	ignored
jammy	ignored
noble	ignored
questing	ignored
xenial	ignored

Common Weakness Enumeration

CWE-426 - Untrusted Search Path
The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.

References

https://artifex.com/

https://casper.mupdf.com/downloads/archive/mupdf-1.26.2-windows.zip

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=ebb125334eb007d64e579204af3c264aadf2e244

https://vuldb.com/?ctiid.344924

https://vuldb.com/?id.344924

https://vuldb.com/?submit.750978