CVE-2025-46206 PoC — artifex mupdf 安全漏洞

Source

https://github.com/Landw-hub/CVE-2025-46206

Associated Vulnerability

Title:artifex mupdf 安全漏洞 (CVE-2025-46206)
Description:artifex mupdf是个人开发者的一款富文本编辑器。富文本编辑器不同于文本编辑器，程序员可到网上下载免费的富文本编辑器内嵌于自己的网站或程序里（当然付费的功能会更强大些），方便用户编辑文章或信息。 artifex mupdf 1.25.6版本和1.25.5版本存在安全漏洞，该漏洞源于处理特制PDF文件时mutool clean工具出现无限递归，可能导致拒绝服务。

Readme

There is a denial of service vulnerability in MuPDF 1.25.6 and earlier versions. When an attacker runs the "mutool clean poc /dev/null" command, the program will fall into an infinite recursion between the strip_outlines() and strip_outline() functions in pdf-clean-file.c until the stack is exhausted.

See the attachment for the specific POC file, vulnerability cause, reproduction process and repair suggestions.

The vendor (Artifex Software, maintainer of MuPDF) has acknowledged the issue and fixed the bug. The fix has been committed in their official repository.

Here is the public link to the patch / commit provided by the vendor:
https://bugs.ghostscript.com/show_bug.cgi?id=708521
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0ec7e4d2201bb6df217e01c17396d36297abf9ac

This confirms that the vulnerability has been acknowledged and remediated.

File Snapshot


 [4.0K]  /data/pocs/eb00f2929b18118c0c17507ec60cc63c793397c3
├── [1.4K]  mupdf-clean-poc
├── [ 878]  README.md
├── [638K]  vulnerability cause.doc
└── [517K]  vulnerability reproduction process.doc

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!