The MuPDF Vulnerability Turning “Safe” PDFs into System Hijackers

A high-severity integer overflow (CVE-2026-3308, CVSS 7.8) was discovered in Artifex MuPDF's image processing (pdf-image.c) where stride/size checks use SIZE_MAX instead of INT_MAX, enabling a heap out-of-bounds write and possible arbitrary code execution when rendering crafted PDFs; the flaw affects MuPDF ≤1.27.0, the vendor was reportedly unreachable, a community pull request exists but no official vendor patch has been released, and mitigations include not processing untrusted PDFs, sandboxing rendering, and disabling automatic rendering.