CVE-2025-15569

Executive Summary

CVE-2025-15569 is a local privilege escalation vulnerability in Artifex MuPDF versions up to 1.26.1 on Windows. The flaw resides in the get_system_dpi function within platform/x11/win_main.c, where an uncontrolled search path (CWE-427) allows an attacker with local access to execute arbitrary code by placing a malicious DLL in a directory searched before the intended system path. The attack requires high complexity and local access, making it difficult to exploit but impactful if successful. The vendor has released a patch in version 1.26.2.

Supply Chain & Package Security

This vulnerability affects the MuPDF library, which is distributed as a standalone application and as a component in various software packages. Users should verify the integrity of their MuPDF installation and ensure they are using the patched version (1.26.2 or later). No known supply chain attacks have been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the description, a more realistic score is 5.3 (Medium).
• Attack Vector: Local (AV:L)
• Attack Complexity: High (AC:H)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)
• Threat Level: Medium – Exploitation is difficult but possible with local access.

Deep Dive & Mechanics

The vulnerability is a classic uncontrolled search path (DLL hijacking) issue. The get_system_dpi function in platform/x11/win_main.c attempts to load a system DLL (likely related to DPI retrieval) without specifying an absolute path. On Windows, the DLL search order includes the application's directory, the current working directory, and system directories. An attacker with local access can place a malicious DLL with the same name as the expected system DLL in a directory that is searched before the legitimate system path (e.g., the application's directory). When MuPDF calls get_system_dpi, the malicious DLL is loaded instead, executing arbitrary code in the context of the MuPDF process.

The attack requires:

• Local access to the system.
• Ability to write to a directory in the DLL search path (e.g., the MuPDF installation directory).
• Knowledge of the specific DLL name being loaded.

Vulnerable vs. Patched Code

Vulnerable Code (1.26.1 and earlier):

// platform/x11/win_main.c
static int get_system_dpi(void) {
    // Loads a DLL without full path
    HINSTANCE hDLL = LoadLibrary("dpi.dll"); // Example - actual DLL name unknown
    // ... uses hDLL
}

Patched Code (1.26.2):

// platform/x11/win_main.c
static int get_system_dpi(void) {
    // Uses absolute path to system DLL
    HINSTANCE hDLL = LoadLibrary("C:\\Windows\\System32\\dpi.dll"); // Example
    // ... uses hDLL
}

The patch ensures that the DLL is loaded from a secure system directory, preventing hijacking.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install MuPDF 1.26.1 on a Windows 10/11 VM.
2. Create a malicious DLL (e.g., dpi.dll) that executes a payload (e.g., reverse shell).
3. Place the malicious DLL in the MuPDF installation directory (e.g., C:\Program Files\MuPDF\).
4. Run MuPDF (e.g., mupdf.exe). The get_system_dpi function will load the malicious DLL.

Example Malicious DLL Code (C):

// dll.c
#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute payload (e.g., reverse shell)
        WinExec("calc.exe", SW_SHOW); // Example: launch calculator
    }
    return TRUE;
}

Compile with: x86_64-w64-mingw32-gcc -shared -o dpi.dll dll.c

Blue Team

Detection:

• Monitor for unexpected DLL loads in the MuPDF process.
• Use Sysmon to log DLL load events (Event ID 7).
• Look for LoadLibrary calls from MuPDF that load DLLs from non-system paths.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName == "mupdf.exe"
| where ProcessIntegrityLevel == "Medium"
| where ActionType == "DllLoaded"
| where FolderPath !startswith "C:\\Windows\\System32\\"

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes depend on the malicious DLL)
  • dpi.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process: mupdf.exe loading DLLs from non-system paths.
• Registry: N/A
• Network: N/A (local attack)

Detection Engineering

YARA Rule

rule CVE_2025_15569_MuPDF_DLL_Hijack {
    meta:
        description = "Detects MuPDF DLL hijacking attempt"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15569"
    strings:
        $s1 = "get_system_dpi" ascii wide nocase
        $s2 = "LoadLibrary" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: MuPDF DLL Hijacking via Uncontrolled Search Path
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects MuPDF loading DLLs from non-system paths
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15569
logsource:
    product: windows
    service: sysmon
    category: image_load
detection:
    selection:
        Image|endswith: '\mupdf.exe'
        ImageLoaded|startswith:
            - 'C:\Program Files\MuPDF\'
            - 'C:\Users\'
    condition: selection
falsepositives:
    - Legitimate DLLs in MuPDF directory
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-15569 MuPDF DLL Hijack Attempt"; flow:to_server; content:"mupdf.exe"; nocase; content:"LoadLibrary"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to MuPDF version 1.26.2 or later.
2. Workaround: If upgrade is not possible, restrict write access to the MuPDF installation directory to prevent DLL placement.
3. Monitoring: Enable DLL load logging (Sysmon Event ID 7) and alert on MuPDF loading DLLs from non-system paths.
4. Principle of Least Privilege: Run MuPDF with minimal privileges to limit the impact of exploitation.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert