CVE-2025-46206

Published: Aug 4, 2025Modified: Jul 5, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion

Affected (1)

Products: Artifex: Mupdf

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Artifex Mupdf	Up to 1.25.6

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (3)

https://bugs.ghostscript.com/show_bug.cgi?id=708521

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0ec7e4d2201bb6df217e01c17396d36297abf9ac

Source: cve@mitre.org

Permissions Required

https://github.com/Landw-hub/CVE-2025-46206

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.