CVE-2025-55780: 
NixOS vulnerability analysis and mitigation

CVE-2025-55780 is a null pointer dereference vulnerability in MuPDF's EPUB rendering engine, specifically in the break_word_for_overflow_wrap() function. When processing a malformed EPUB document, the function calls fz_html_split_flow() to split a FLOW_WORD node but fails to validate that node->next is non-NULL before accessing node->next->overflow_wrap, causing a crash. Affected versions span MuPDF 1.24.0 through 1.26.6 (fixed in 1.26.7 and upstream 1.27.x). The vulnerability was publicly disclosed on September 23, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in MuPDF's HTML layout engine. When rendering EPUB content with the overflow-wrap: break-word CSS property applied to right-to-left (RTL) text, the cluster-walking logic in break_word_for_overflow_wrap() can fail to actually split the flow node — leaving node->next as NULL — after which the code unconditionally dereferences node->next->overflow_wrap. The underlying trigger is that RTL text causes clusters to arrive in reverse order, confusing the splitting logic. The fix, committed upstream at bdd5d241748807378a78a622388e0312332513c5, introduces RTL-aware cluster splitting and switches HarfBuzz calls to grapheme-cluster mode to correctly group clusters (GitHub PoC, Red Hat Bugzilla).

Successful exploitation results in a denial of service (DoS) by crashing the MuPDF rendering process. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Any application or service that uses MuPDF to render EPUB documents from untrusted sources (e.g., document viewers, e-book readers, server-side document processors) is at risk of process termination when a crafted EPUB is opened (Red Hat CVE, GitHub PoC).

No public proof-of-concept exploit code with a working reproducer has been confirmed; the upstream bug report notes the reproducer is private. A GitHub repository (ISH2YU/CVE-2025-55780) documents the crash location and fix details but does not include a weaponized exploit. There is no evidence of in-the-wild exploitation, no CISA KEV listing, and the EPSS score is approximately 0.018% — indicating very low probability of near-term exploitation (GitHub PoC, Red Hat CVE).

1. Craft malicious EPUB: Create a specially crafted EPUB document containing RTL text (e.g., Arabic or Hebrew) styled with overflow-wrap: break-word CSS, designed to trigger the faulty cluster-splitting path in break_word_for_overflow_wrap().
2. Deliver the document: Provide the malformed EPUB to a target system running a vulnerable MuPDF version (1.24.0–1.26.6) — for example, via email attachment, file upload to a document processing service, or a malicious download link.
3. Trigger rendering: Cause MuPDF to open and render the EPUB (e.g., by the user opening it in a MuPDF-based viewer, or an automated pipeline processing it server-side).
4. Crash occurs: The fz_html_split_flow() call fails to split the RTL FLOW_WORD node, leaving node->next as NULL; the subsequent access to node->next->overflow_wrap triggers an access violation (code c0000005 on Windows), crashing the process and causing a denial of service (GitHub PoC, Red Hat Bugzilla).

• Process: MuPDF process terminating unexpectedly with an access violation (Windows: exception code c0000005 at mupdf!break_word_for_overflow_wrap+0x243; Linux: segmentation fault in break_word_for_overflow_wrap).
• Logs: Application crash logs or core dumps referencing break_word_for_overflow_wrap, fz_html_split_flow, or null pointer dereference at address 0x0000000000000000.
• File System: Presence of suspicious EPUB files with RTL text content and overflow-wrap: break-word CSS styling in directories processed by MuPDF-based applications.
• Network: Repeated delivery of EPUB files from external sources to document processing endpoints, particularly if followed by service restarts or crash reports (GitHub PoC).

Upgrade MuPDF to version 1.26.7 or later (upstream fix is in 1.27.x); the specific fix commit is bdd5d241748807378a78a622388e0312332513c5 in the Ghostscript/MuPDF repository. Fedora packages are being updated to 1.26.9 with the backported fix; openSUSE has released updated packages as well. As interim workarounds: restrict EPUB rendering to trusted sources only, use sandboxing (e.g., containers or seccomp) when processing documents from untrusted inputs, and consider alternative EPUB renderers if patching is not immediately feasible (Red Hat Bugzilla, GitHub PoC).

A Bluesky post from a security researcher noted the vulnerability shortly after disclosure. An article on antihackingonline.com highlighted the relevance of the flaw to AI/LLM developers who may use MuPDF for document ingestion pipelines, warning against underestimating the design flaw. Coverage appeared in German Linux security outlet pro-linux.de and linuxsecurity.com, primarily focused on the Fedora and openSUSE package updates. Overall community reaction has been low-key, consistent with the limited exploitability and DoS-only impact.