CVE-2020-26683: 
NixOS vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2020-26683) was discovered in Artifex Software MuPDF version 1.17.0. The vulnerability specifically affects the /pdf/pdf-font-add.c component of the software (NVD).

The vulnerability is classified as a memory leak issue (CWE-401: Missing Release of Memory after Effective Lifetime) with a CVSS v3.1 Base Score of 5.5 (MEDIUM). The attack vector is local (AV:L) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). The scope is unchanged (S:U) with high confidentiality impact (C:H) but no impact on integrity (I:N) or availability (A:N) (NVD).

The vulnerability allows attackers to obtain sensitive information through memory leaks. The issue specifically occurs in the pdfnewarray function, where direct leaks of 320 bytes in 8 objects and indirect leaks of 896 bytes across multiple allocations were identified (Ghostscript Bugzilla).

The vulnerability was fixed in a subsequent update through commit 05720b4ee3dbae57e65546dc2eecc3021c08eeea, which addressed the memory leak by ensuring proper cleanup of runobj in the pdfaddcidfont_widths function (Ghostscript Git).