CVE-2026-3308: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3308 is an integer overflow vulnerability in Artifex MuPDF affecting version 1.27.0 (and earlier) that allows an attacker to craft a malicious PDF triggering an integer overflow in the pdf_load_image_imp function, leading to a heap out-of-bounds write potentially exploitable for arbitrary code execution. The vulnerability was reported by Yarden Porat from Cyata, disclosed publicly on March 31, 2026, and assigned a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, CERT/CC).

The root cause is an integer overflow (CWE-190) in pdf_load_image_imp within pdf-image.c, where image parameters — width (w), height (h), and bits-per-component (bpc) — are used to compute a stride value using 32-bit integer arithmetic. The existing bounds check validates against SIZE_MAX rather than INT_MAX, failing to prevent overflow when excessively large values are supplied. The overflowed stride value is then passed to fz_unpack_stream (in source/fitz/draw-unpack.c), which uses it to allocate an undersized heap buffer and subsequently writes beyond its bounds. The fix replaces the 32-bit stride calculation (w*depth*n+7)>>3 with 64-bit math ((int64_t)w*depth*n+7)>>3 to prevent the overflow (MuPDF Commit, CERT/CC). Exploitation requires user interaction — a victim must open a specially crafted PDF file using a vulnerable MuPDF-based application.

Successful exploitation results in a heap out-of-bounds write during PDF image decoding, which can cause application crashes (denial of service) or, in more severe cases, arbitrary code execution within the context of the application rendering the PDF. All three security pillars are affected at a high level: confidentiality, integrity, and availability. Any system that automatically processes or renders untrusted PDF files using MuPDF 1.27.0 or earlier — including applications embedding PyMuPDF — is at risk (CERT/CC, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017–0.023%, placing it in a low percentile for near-term exploitation likelihood. Exploitation requires user interaction (opening a malicious PDF), which reduces the attack surface compared to fully remote, unauthenticated vectors.

1. Craft a malicious PDF: Create a PDF containing an image stream with excessively large width (w), height (h), or bits-per-component (bpc) values designed to trigger integer overflow in the src_stride calculation within pdf_load_image_imp.
2. Trigger overflow: When MuPDF 1.27.0 processes the image, the expression (w*depth*n+7)>>3 overflows a 32-bit integer, producing a small or negative stride value.
3. Undersized buffer allocation: The corrupted stride value is passed to fz_unpack_stream, which allocates a heap buffer based on the overflowed (too-small) size.
4. Heap out-of-bounds write: As fz_unpack_stream unpacks image samples into the undersized buffer, it writes beyond the allocated heap region, corrupting adjacent memory.
5. Achieve code execution or crash: Depending on heap layout and platform mitigations, the memory corruption may crash the application or, with further exploitation techniques (e.g., heap grooming), enable arbitrary code execution in the context of the MuPDF process (CERT/CC, MuPDF Commit).

• Process: Unexpected crashes or segmentation faults in MuPDF-based applications (e.g., mupdf, mutool, or applications embedding PyMuPDF) when opening PDF files, particularly those containing image streams with unusually large dimension values.
• Logs: Application crash logs or core dumps referencing pdf_load_image_imp, fz_unpack_stream, or draw-unpack.c stack frames; heap corruption error messages from memory allocators.
• File System: Presence of suspicious or externally sourced PDF files with anomalous image stream parameters (very large Width, Height, or BitsPerComponent values in image dictionaries).
• Network: Unexpected outbound connections from PDF-rendering processes following the opening of an untrusted PDF file, which may indicate post-exploitation activity.

A fix is available via commit a26f0142e7d390d4a82c6e5ae0e312e07cc4ec85 in the MuPDF repository, which changes the stride calculation to use 64-bit arithmetic to prevent overflow; users should update to a patched build incorporating this commit (MuPDF Commit). Debian has issued security advisories (DSA-6218-1 and DLA-4540-1) and Fedora has released updated packages addressing this vulnerability. As a workaround, organizations should avoid processing untrusted PDF files with affected MuPDF-based applications, isolate document rendering in sandboxed or low-privilege processes, and disable automatic rendering or conversion of untrusted files where feasible (CERT/CC).

The vulnerability was discovered and reported by Yarden Porat from Cyata and coordinated through CERT/CC, which published Vulnerability Note VU#951662 on April 2, 2026 (CERT/CC). Security news outlets including SecurityOnline.info covered the vulnerability, highlighting the RCE potential (SecurityOnline). The Hacker News included it in a weekly vulnerability recap, and Linux distribution security teams (Debian, Fedora) responded promptly with updated packages. CERT/CC noted that the vendor was initially unreachable for coordinated disclosure.