CVE-2025-46206

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p32

Published

Aug 4, 2025 (Aug 4, 2025)

Modified

Jul 5, 2026

Description

An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion

Vendors: artifex
Products: mupdf
Weakness: CWE-674
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.