CVE-2026-7233: 
NixOS vulnerability analysis and mitigation

CVE-2026-7233 is a heap out-of-bounds read vulnerability in Artifex MuPDF affecting versions up to and including 1.28.0. The flaw resides in the fz_subset_cff_for_gids function within subset-cff.c, part of the CFF (Compact Font Format) Index Handler component. It was publicly disclosed on April 28, 2026, with a proof-of-concept exploit available at the time of disclosure. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause is an off-by-one validation error (CWE-125: Out-of-bounds Read; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the index_load() function in subset-cff.c. The validation at line 315 checks the raw relative offset v against the total CFF buffer length len, but index_get() returns data_offset + v — an absolute file position. Because data_offset > 0 for any CFF INDEX not starting at byte 0, a crafted CFF where v_last == len passes validation while index_get(count) computes to data_offset + len > len. This causes do_subset() to invoke memcpy() past the end of the allocated CFF buffer — in the demonstrated case, reading 1039 bytes starting at position 39 of a 1041-byte allocation, overflowing the heap right redzone by 37 bytes. Exploitation requires local access and low privileges; no user interaction is needed (PoC Repository).

Successful exploitation results in two primary consequences: a denial-of-service crash of the mutool process when processing a crafted PDF, and a potential information disclosure where up to 37+ bytes of adjacent heap memory are copied verbatim into the output PDF's subsetted font stream, potentially exposing sensitive heap contents to the PDF consumer. There is no integrity impact, and the vulnerability is confined to the local system with no lateral movement potential. The affected asset scope is limited to applications using Artifex MuPDF for PDF processing, particularly those invoking font subsetting operations (PoC Repository, Github Advisory).

A public proof-of-concept exploit is available on GitHub, including a crafted PDF file (poc_indexload_oob_read.pdf) and reproduction steps using mutool clean -S. The EPSS score is approximately 0.012% (0.000120), indicating a low probability of near-term exploitation in the wild. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The Artifex project had not publicly responded to the bug report at the time of disclosure (PoC Repository, Red Hat Bugzilla).

1. Craft a malicious PDF: Create or use the provided PoC PDF (poc_indexload_oob_read.pdf) containing a specially crafted CFF font where the last INDEX offset v_last equals the total CFF buffer length len, and the INDEX's data_offset is greater than zero (e.g., 38 bytes), so that index_get(count) = data_offset + len > len.
2. Deliver the PDF: Place the crafted PDF in a location accessible to the target MuPDF process (local file system, shared directory, or via a service that processes user-supplied PDFs).
3. Trigger font subsetting: Execute mutool clean -S poc_indexload_oob_read.pdf /tmp/output.pdf or any MuPDF-based operation that invokes CFF font subsetting on the malicious PDF. This triggers fz_subset_cff_for_gids → do_subset() → memcpy() past the heap buffer boundary.
4. Observe impact: The process crashes (DoS) due to the heap-buffer-overflow, and/or the output PDF's subsetted font stream contains up to 37+ bytes of adjacent heap memory, which can be extracted by reading the output file (PoC Repository).

• File System: Presence of crafted PDF files with malformed CFF font data (e.g., poc_indexload_oob_read.pdf or similar); unexpected output PDF files containing anomalous binary data in font streams.
• Process: Crashes or abnormal termination of mutool or other MuPDF-based processes when processing PDF files; ASAN/sanitizer output referencing heap-buffer-overflow in memcpy within subset-cff.c.
• Logs: Application error logs showing FZ_ERROR_FORMAT or memory-related errors from MuPDF; core dump files generated by mutool processes; system logs indicating repeated crashes of PDF processing services.

Update Artifex MuPDF to a version beyond 1.28.0 once an official patch is released by Artifex. In the interim, restrict PDF processing to trusted input sources and avoid processing untrusted or externally supplied PDF files with MuPDF-based tools. Consider sandboxing PDF processing operations (e.g., using containers or restricted user accounts) to limit the impact of crashes or heap memory disclosure. Red Hat and GitHub Security Advisories have tracked the issue, and patches are expected through those channels (Red Hat Bugzilla, Github Advisory).

Red Hat's Product Security team filed a bug report (BZ#2463367) and classified the severity as low, with a Nessus detection plugin (ID 310837) added by Tenable shortly after disclosure. A Red Hat engineer noted the upstream Ghostscript/MuPDF bug tracker entry (bug #709328) as the authoritative upstream report. No significant public commentary from the broader security research community or major media coverage has been observed, consistent with the vulnerability's low severity and local-only attack vector (Red Hat Bugzilla).