CVE-2026-7233

Executive Summary

CVE-2026-7233 is a locally exploitable out-of-bounds read vulnerability in Artifex MuPDF up to version 1.28.0. The flaw resides in the fz_subset_cff_for_gids function within the subset-cff.c file, part of the CFF Index Handler component. An attacker with local access can craft a malicious PDF or CFF file that, when processed by MuPDF, triggers an out-of-bounds read, potentially leading to information disclosure or denial of service. The vulnerability has a CVSS score of 3.3 (Low), and while the EPSS score is 0.0%, the exploit has been publicly disclosed. No patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability affects the MuPDF library, which is a core dependency for many PDF processing applications and services. Organizations using MuPDF in their software supply chain should assess their exposure and consider temporary mitigations until an official patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Attack Vector: Local (AV:L) – Requires local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – User must open a malicious file.
• Scope: Unchanged (S:U) – Impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service expected.

Threat Level: Low. The attack requires local access and user interaction, and the impact is limited to information disclosure.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds read in the CFF (Compact Font Format) index handler of MuPDF. The CFF format is used for embedding fonts in PDF files. The function fz_subset_cff_for_gids is responsible for subsetting CFF fonts by selecting specific glyph IDs (GIDs). The flaw occurs when the function reads from a CFF index without properly validating the bounds of the index data.

When a maliciously crafted CFF font is processed, the function may attempt to read beyond the allocated buffer, leading to an out-of-bounds read. This can leak sensitive memory contents or cause a crash. The attack is triggered when a user opens a specially crafted PDF file containing the malicious CFF font.

Vulnerable vs. Patched Code

Vulnerable Code (MuPDF <= 1.28.0): The vulnerable code in subset-cff.c does not properly check the bounds of the CFF index before reading. For example:

int fz_subset_cff_for_gids(fz_context *ctx, fz_buffer *buf, ...) {
    // ...
    for (i = 0; i < count; i++) {
        int offset = get_offset(data, i); // No bounds check
        // ...
    }
    // ...
}

Patched Code (Hypothetical): A proper fix would include bounds checking before accessing the index:

int fz_subset_cff_for_gids(fz_context *ctx, fz_buffer *buf, ...) {
    // ...
    for (i = 0; i < count; i++) {
        if (i >= index_count) break; // Bounds check
        int offset = get_offset(data, i);
        // ...
    }
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• MuPDF version <= 1.28.0 installed on a local system.
• Ability to craft a malicious PDF with a malformed CFF font.

Exploitation Steps:

1. Create a malicious CFF font that triggers the out-of-bounds read.
2. Embed the font into a PDF file.
3. Deliver the PDF to the target user (e.g., via email or file share).
4. When the user opens the PDF with MuPDF, the out-of-bounds read occurs, potentially leaking memory contents.

Proof-of-Concept (PoC):

# PoC script to generate a malicious PDF with a malformed CFF font
# This is a simplified example; actual exploitation requires deep CFF knowledge.
import struct

def create_malicious_cff():
    # Craft a malformed CFF index with out-of-bounds offsets
    data = b'\x01\x00'  # Major, minor version
    data += b'\x04'      # Top dict size
    data += b'\x00\x00\x00\x00'  # Top dict
    data += b'\x01'      # String index count
    data += b'\x00\x00'  # Offset size
    data += b'\x00\x00'  # Data
    # Malicious index with out-of-bounds offset
    data += b'\x02'      # Index count
    data += b'\x02'      # Offset size
    data += b'\x00\x00'  # Offset 1
    data += b'\xff\xff'  # Offset 2 (out-of-bounds)
    return data

# Generate the malicious CFF and embed in PDF
cff_data = create_malicious_cff()
# ... (PDF generation code omitted for brevity)

Blue Team

Detection:

• Monitor for crashes or abnormal behavior in MuPDF processes.
• Use file integrity monitoring to detect malicious PDF files.
• Implement user awareness training to avoid opening suspicious PDFs.

Mitigation:

• Restrict execution of MuPDF to trusted users only.
• Use application whitelisting to prevent unauthorized PDF processing.
• Consider using alternative PDF libraries until a patch is available.

Indicators of Compromise (IOCs)

• File Hashes: (Example – actual hashes will vary)
  • malicious.pdf: SHA256 a1b2c3d4e5f6...
• Process Anomalies:
  • MuPDF process crashes or segmentation faults.
  • Unexpected memory access patterns in MuPDF.
• Network Indicators:
  • No network indicators expected as this is a local vulnerability.

Detection Engineering

YARA Rule

rule CVE_2026_7233_MuPDF_CFF_OOB_Read {
    meta:
        description = "Detects malicious PDF files exploiting CVE-2026-7233"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-7233"
    strings:
        $cff_magic = { 01 00 }  // CFF version 1.0
        $oob_offset = { ff ff }  // Potential out-of-bounds offset
    condition:
        $cff_magic at 0 and $oob_offset
}

Sigma Rule

title: CVE-2026-7233 MuPDF CFF Out-of-Bounds Read
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects MuPDF crashes or abnormal behavior related to CFF processing
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\mupdf.exe'
        CommandLine|contains: '.pdf'
    condition: selection
falsepositives:
    - Legitimate PDF processing
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-7233 MuPDF CFF Out-of-Bounds Read"; flow:to_client,established; content:"|01 00|"; offset:0; depth:2; content:"|ff ff|"; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable CFF font processing in MuPDF if possible, or restrict usage to trusted files only.
2. Monitor for updates from Artifex regarding a patch.
3. Implement file scanning for malicious PDFs using YARA rules.

Long-term Fix:

• Apply the official patch once released by Artifex.
• Upgrade to a patched version of MuPDF (future release > 1.28.0).

Workarounds:

• Use alternative PDF libraries (e.g., Poppler, PDFium) for critical operations.
• Run MuPDF in a sandboxed environment to limit impact.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 08005339D50BD018529A1089] */}