CVE-2026-7233

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7233", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-27T17:00:07.970Z", "datePublished": "2026-04-28T06:00:18.874Z", "dateUpdated": "2026-11-01T07:27:29.629Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-01T07:27:29.629Z"}, "title": "Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "Artifex", "product": "MuPDF", "versions": [{"version": "1.24.0", "status": "affected"}, {"version": "1.24.1", "status": "affected"}, {"version": "1.24.2", "status": "affected"}, {"version": "1.24.3", "status": "affected"}, {"version": "1.24.4", "status": "affected"}, {"version": "1.24.5", "status": "affected"}, {"version": "1.24.6", "status": "affected"}, {"version": "1.24.7", "status": "affected"}, {"version": "1.24.8", "status": "affected"}, {"version": "1.24.9", "status": "affected"}, {"version": "1.24.10", "status": "affected"}, {"version": "1.24.11", "status": "affected"}, {"version": "1.25.0", "status": "affected"}, {"version": "1.25.1", "status": "affected"}, {"version": "1.25.2", "status": "affected"}, {"version": "1.25.3", "status": "affected"}, {"version": "1.25.4", "status": "affected"}, {"version": "1.25.5", "status": "affected"}, {"version": "1.25.6", "status": "affected"}, {"version": "1.26.0", "status": "affected"}, {"version": "1.26.1", "status": "affected"}, {"version": "1.26.2", "status": "affected"}, {"version": "1.26.3", "status": "affected"}, {"version": "1.26.4", "status": "affected"}, {"version": "1.26.5", "status": "affected"}, {"version": "1.26.6", "status": "affected"}, {"version": "1.26.7", "status": "affected"}, {"version": "1.26.8", "status": "affected"}, {"version": "1.26.9", "status": "affected"}, {"version": "1.26.10", "status": "affected"}, {"version": "1.26.11", "status": "affected"}, {"version": "1.26.12", "status": "affected"}, {"version": "1.27.0", "status": "affected"}, {"version": "1.27.1", "status": "affected"}, {"version": "1.27.2", "status": "affected"}, {"version": "1.28.0", "status": "affected"}], "cpes": ["cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*"], "modules": ["CFF Index Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-27T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-27T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-01T08:29:10.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "biniam (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "rmelotte (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359840", "name": "VDB-359840 | Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359840/cti", "name": "VDB-359840 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-7233", "name": "CVE-2026-7233 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/802590", "name": "Submit #802590 | Artifex MuPDF 1.28 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709328", "tags": ["issue-tracking"]}, {"url": "https://github.com/biniamf/pocs/tree/main/mupdf-cff-indexload-oobread", "tags": ["exploit"]}, {"url": "https://artifex.com/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"references": [{"url": "https://vuldb.com/submit/802590", "tags": ["exploit"]}, {"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709328", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-29T15:14:06.670638Z", "id": "CVE-2026-7233", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-05T20:23:51.185Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7233", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-29T15:14:06.670638Z"}}}], "references": [{"url": "https://vuldb.com/submit/802590", "tags": ["exploit"]}, {"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709328", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T15:14:50.739Z"}}], "cna": {"title": "Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds", "credits": [{"lang": "en", "type": "reporter", "value": "biniam (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "rmelotte (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*"], "vendor": "Artifex", "modules": ["CFF Index Handler"], "product": "MuPDF", "versions": [{"status": "affected", "version": "1.24.0"}, {"status": "affected", "version": "1.24.1"}, {"status": "affected", "version": "1.24.2"}, {"status": "affected", "version": "1.24.3"}, {"status": "affected", "version": "1.24.4"}, {"status": "affected", "version": "1.24.5"}, {"status": "affected", "version": "1.24.6"}, {"status": "affected", "version": "1.24.7"}, {"status": "affected", "version": "1.24.8"}, {"status": "affected", "version": "1.24.9"}, {"status": "affected", "version": "1.24.10"}, {"status": "affected", "version": "1.24.11"}, {"status": "affected", "version": "1.25.0"}, {"status": "affected", "version": "1.25.1"}, {"status": "affected", "version": "1.25.2"}, {"status": "affected", "version": "1.25.3"}, {"status": "affected", "version": "1.25.4"}, {"status": "affected", "version": "1.25.5"}, {"status": "affected", "version": "1.25.6"}, {"status": "affected", "version": "1.26.0"}, {"status": "affected", "version": "1.26.1"}, {"status": "affected", "version": "1.26.2"}, {"status": "affected", "version": "1.26.3"}, {"status": "affected", "version": "1.26.4"}, {"status": "affected", "version": "1.26.5"}, {"status": "affected", "version": "1.26.6"}, {"status": "affected", "version": "1.26.7"}, {"status": "affected", "version": "1.26.8"}, {"status": "affected", "version": "1.26.9"}, {"status": "affected", "version": "1.26.10"}, {"status": "affected", "version": "1.26.11"}, {"status": "affected", "version": "1.26.12"}, {"status": "affected", "version": "1.27.0"}, {"status": "affected", "version": "1.27.1"}, {"status": "affected", "version": "1.27.2"}, {"status": "affected", "version": "1.28.0"}]}], "timeline": [{"lang": "en", "time": "2026-04-27T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-27T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-11-01T08:29:10.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359840", "name": "VDB-359840 | Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359840/cti", "name": "VDB-359840 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-7233", "name": "CVE-2026-7233 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/802590", "name": "Submit #802590 | Artifex MuPDF 1.28 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709328", "tags": ["issue-tracking"]}, {"url": "https://github.com/biniamf/pocs/tree/main/mupdf-cff-indexload-oobread", "tags": ["exploit"]}, {"url": "https://artifex.com/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-01T07:27:29.629Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7233", "state": "PUBLISHED", "dateUpdated": "2026-11-01T07:27:29.629Z", "dateReserved": "2026-04-27T17:00:07.970Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-28T06:00:18.874Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*"], "modules": ["CFF Index Handler"], "product": "MuPDF", "vendor": "Artifex", "versions": [{"status": "affected", "version": "1.24.0"}, {"status": "affected", "version": "1.24.1"}, {"status": "affected", "version": "1.24.2"}, {"status": "affected", "version": "1.24.3"}, {"status": "affected", "version": "1.24.4"}, {"status": "affected", "version": "1.24.5"}, {"status": "affected", "version": "1.24.6"}, {"status": "affected", "version": "1.24.7"}, {"status": "affected", "version": "1.24.8"}, {"status": "affected", "version": "1.24.9"}, {"status": "affected", "version": "1.24.10"}, {"status": "affected", "version": "1.24.11"}, {"status": "affected", "version": "1.25.0"}, {"status": "affected", "version": "1.25.1"}, {"status": "affected", "version": "1.25.2"}, {"status": "affected", "version": "1.25.3"}, {"status": "affected", "version": "1.25.4"}, {"status": "affected", "version": "1.25.5"}, {"status": "affected", "version": "1.25.6"}, {"status": "affected", "version": "1.26.0"}, {"status": "affected", "version": "1.26.1"}, {"status": "affected", "version": "1.26.2"}, {"status": "affected", "version": "1.26.3"}, {"status": "affected", "version": "1.26.4"}, {"status": "affected", "version": "1.26.5"}, {"status": "affected", "version": "1.26.6"}, {"status": "affected", "version": "1.26.7"}, {"status": "affected", "version": "1.26.8"}, {"status": "affected", "version": "1.26.9"}, {"status": "affected", "version": "1.26.10"}, {"status": "affected", "version": "1.26.11"}, {"status": "affected", "version": "1.26.12"}, {"status": "affected", "version": "1.27.0"}, {"status": "affected", "version": "1.27.1"}, {"status": "affected", "version": "1.27.2"}, {"status": "affected", "version": "1.28.0"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*", "matchCriteriaId": "296A0B90-FB84-41D4-8CEB-0AA45570E584", "versionEndIncluding": "1.27.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en Artifex MuPDF hasta 1.28.0. El elemento afectado es la funci\u00f3n fz_subset_cff_for_gids del archivo subset-cff.c del componente Gestor de \u00cdndice CFF. Esta manipulaci\u00f3n causa una lectura fuera de l\u00edmites. El ataque solo puede ejecutarse localmente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de error, pero a\u00fan no ha respondido."}], "id": "CVE-2026-7233", "lastModified": "2026-11-01T08:17:43.850", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7233", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-29T15:14:06.670638Z", "version": "2.0.3"}}]}, "published": "2026-04-28T07:16:04.067", "references": [{"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://artifex.com/"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://bugs.ghostscript.com/show_bug.cgi?id=709328"}, {"source": "cna@vuldb.com", "tags": ["Exploit"], "url": "https://github.com/biniamf/pocs/tree/main/mupdf-cff-indexload-oobread"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-7233"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/submit/802590"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/vuln/359840"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/vuln/359840/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://bugs.ghostscript.com/show_bug.cgi?id=709328"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/submit/802590"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mupdf: Artifex MuPDF: Information disclosure due to out-of-bounds read", "id": "2463367", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463367"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in Artifex MuPDF, specifically within its CFF Index Handler component. A local user could exploit an out-of-bounds read vulnerability in the `fz_subset_cff_for_gids` function. This could allow an attacker to read sensitive information from memory, potentially leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "Users should avoid opening untrusted or malicious PDF documents with applications that utilize the MuPDF library. If the `mupdf` package is not essential for system operation, consider removing it to eliminate the attack surface."}, "name": "CVE-2026-7233", "public_date": "2026-04-28T06:00:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-7233\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-7233\nhttps://artifex.com/\nhttps://bugs.ghostscript.com/show_bug.cgi?id=709328\nhttps://github.com/biniamf/pocs/tree/main/mupdf-cff-indexload-oobread\nhttps://vuldb.com/submit/802590\nhttps://vuldb.com/vuln/359840\nhttps://vuldb.com/vuln/359840/cti"], "statement": "This vulnerability is rated as Low impact. The out-of-bounds read in Artifex MuPDF's CFF Index Handler requires local user access to exploit, limiting its potential for widespread impact on Red Hat systems. Successful exploitation could lead to information disclosure from memory.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0,1.28.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "MuPDF", "source": "cna", "vendor": "Artifex"}, "product": "mupdf", "vendor": "artifex"}], "created": "2026-04-28T08:30:13.033658+00:00", "updated": "2026-11-01T09:00:04.313238+00:00", "vendors": ["artifex", "artifex$PRODUCT$mupdf"]}