CVE-2025-71382 MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering

What is CVE-2025-71382?

CVE-2025-71382 is a high-severity denial of service vulnerability in Artifex Mupdf, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.

Weakness: CWE-674

Which versions are affected by CVE-2025-71382?

It affects 1 product.

Products include Artifex Mupdf.

How do I fix CVE-2025-71382?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-71382 being exploited?

There is no known exploitation of CVE-2025-71382 in the wild and no public exploit code.

Other vulnerabilities in Artifex Mupdf

• CVE-2019-7321 Memory corruption in n/a Critical 9.8
• CVE-2016-6525 Memory corruption in n/a Critical 9.8
• CVE-2011-0341 Memory corruption in n/a Critical 9.3
• CVE-2016-8728 Memory corruption in MuPDF High 8.6
• CVE-2021-3407 Use after free in mupdf High 7.8

All Artifex Mupdf vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-71382, GHSA-mhwh-83qc-j6x4, UBUNTU-CVE-2025-71382.