Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-46206

An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion

Published

2025-08-04T18:15:34.810

Last Modified

2025-10-02T17:39:43.930

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-674

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	artifex	mupdf	≤ 1.25.6	Yes

References

http://artifex.com Product ([email protected])
http://mupdf.com Product ([email protected])
https://bugs.ghostscript.com/show_bug.cgi?id=708521 Issue Tracking, Third Party Advisory ([email protected])
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0ec7e4d2201bb6df217e01c17396d36297abf9ac Permissions Required ([email protected])
https://github.com/Landw-hub/CVE-2025-46206 Exploit, Third Party Advisory ([email protected])