SEC.co
Emergency
MEDIUM 6.5

CVE-2025-71382: MuPDF EPUB Denial of Service via Uncontrolled CSS Recursion

MuPDF, a popular open-source PDF and EPUB rendering library, contains a denial-of-service vulnerability in its EPUB CSS processing engine. An attacker can craft a malicious EPUB file with deeply nested HTML elements and CSS styles that causes the application to recursively process CSS property inheritance without stopping, ultimately crashing any application using MuPDF to read EPUB files. The vulnerability requires user interaction (opening the file) but affects any software embedding MuPDF for document viewing.

Source data · NVD / CISA · public domain

CVSS
3.1 · 6.5 MEDIUM · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses (CWE)
CWE-674
Affected products
1 configuration(s)
Published / Modified
2026-06-23 / 2026-07-14

NVD description (verbatim)

MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.

4 reference(s) · View on NVD →

SEC.co analysis · AI-assisted, reviewed against source

Technical summary

The vulnerability resides in the value_from_inheritable_property() function within css-apply.c, which handles CSS property inheritance during EPUB rendering. The function recurses through the CSS inheritance chain to resolve property values but lacks a depth-limit check. A specially crafted EPUB with pathological nesting of HTML elements combined with inline CSS styles can trigger uncontrolled recursion, exhausting the stack and causing a process crash. This is classified as CWE-674 (Uncontrolled Recursion). The flaw affects MuPDF versions prior to 1.27.0-rc1.

Business impact

Organizations and users relying on MuPDF-based EPUB readers, document management systems, or embedded rendering solutions face availability risk. A user opening a malicious EPUB attachment or file can crash their reading application, disrupting workflow. For server-side deployment (e.g., document conversion services), this could be exploited to deny service to legitimate users. The impact is limited to denial of service with no confidentiality or integrity compromise.

Affected systems

Artifex MuPDF versions before 1.27.0-rc1 are affected. This includes any third-party application or service that embeds MuPDF for EPUB or PDF rendering, including e-reader software, document management platforms, and automated document processing pipelines. Users should verify their MuPDF version and any dependent applications.

Exploitability

Exploitability is relatively straightforward: an attacker crafts a malicious EPUB file and distributes it via email, file-sharing platforms, or compromised websites. When a user or automated system opens the file, the application crashes. No network interaction is required beyond file delivery, and no authentication is necessary. The vulnerability requires user interaction (opening the file), which prevents network-based automated attacks but is easily satisfied in social engineering scenarios or when processing untrusted EPUB files.

Remediation

Update MuPDF to version 1.27.0-rc1 or later. Organizations should prioritize patching applications and services that embed MuPDF. Interim mitigations include disabling EPUB rendering if not essential, restricting EPUB file processing to trusted sources, or sandboxing document viewers. Verify patch availability from Artifex and any downstream vendors integrating MuPDF.

Patch guidance

Upgrade MuPDF to 1.27.0-rc1 or a stable release incorporating this fix (verify against Artifex release notes and advisories). For applications embedding MuPDF, check vendor advisories for patched versions. If upgrading is not immediately possible, disable EPUB rendering or implement input validation to reject deeply nested EPUB structures. Test patches in a non-production environment before rollout, as CSS rendering changes may affect document fidelity.

Detection guidance

Monitor for application crashes or service restarts correlating with EPUB file uploads or processing. Implement file-type inspection on EPUB files (ZIP archives with a specific directory structure) and consider scanning for excessive nesting depth in HTML content before processing. Log all EPUB file processing events and alert on unhandled exceptions in MuPDF-related processes. Network-based detection is limited; focus on endpoint monitoring and application logs.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. CVSS 6.5 (Medium) reflects the high availability impact offset by the need for user interaction. Unlike memory corruption bugs, there is no code execution risk. Prioritize patching for systems handling untrusted EPUB files (email attachments, cloud services) or deployed in high-availability environments where downtime is costly. Systems that only process internal, trusted EPUB files face lower risk.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects high availability impact (AV:N, AC:L, PR:N, UI:R, S:U, C:N, I:N, A:H). Network accessibility and low attack complexity increase severity, but the requirement for user interaction to open a file and absence of data breach risk limit the score. The Medium severity indicates this is a notable operational risk requiring timely remediation, but not a critical vulnerability demanding emergency response.

Frequently asked questions

Can this vulnerability be exploited remotely without user action?

No. The attacker must convince a user to open a malicious EPUB file. However, this is straightforward via email, file-sharing sites, or social engineering, so the practical barrier to exploitation is low.

Does this vulnerability allow data theft or system compromise?

No. The vulnerability causes only a denial of service (application crash). There is no memory corruption, code execution, or access to sensitive data. The risk is operational disruption, not data breach.

Which applications are affected?

Any application embedding MuPDF for EPUB rendering is at risk. This includes e-reader software, document management systems, and automated document processing services. Check your application vendor's advisory to determine if you are affected and when patches are available.

What should I do if I cannot patch immediately?

Restrict EPUB file processing to trusted sources, disable EPUB rendering if not essential, and consider sandboxing document viewers. Monitor for unexpected application crashes and alert on any processing of suspicious EPUB files. Plan patching as soon as updates are available.

This analysis is provided for informational purposes and based on available source data as of the publication date. Readers should verify patch availability, CVSS scores, and affected product versions directly with Artifex Software and relevant vendor advisories before making remediation decisions. SEC.co does not warrant the accuracy or completeness of this assessment. Organizations must conduct their own risk evaluation based on their specific environment, dependencies, and threat model. Source: NVD (public-domain), retrieved 2026-07-28. Analysis generated by SEC.co (claude-haiku-4-5).

Affected vendors

artifex

Weaknesses (CWE)

CWE-674

Related vulnerabilities