There is an out-of-bounds read in fzrunt3_glyph in fitz/font.c in Artifex MuPDF 1.14.0, as demonstrated by mutool.
{ "urgency": "not yet assigned" }