CVE-2025-46206

An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the mutool clean utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the strip_outline() function enters infinite recursion

References

Affected packages

Git / github.com/artifexsoftware/mupdf

Affected ranges

Type

GIT

Repo

https://github.com/artifexsoftware/mupdf

Events

Introduced

Last affected

8610a48f12b71eb7a73b6d68cece78f6342d116f

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.25.6"
        }
    ]
}

Affected versions

0.*

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.*

1.0

1.0rc1

1.1

1.1-forms-tech-preview

1.10

1.10-rc1

1.10-rc2

1.10a

1.11

1.11-rc1

1.11.1

1.12.0

1.13.0

1.13.0-rc1

1.14.0

1.14.0-rc1

1.15.0

1.15.0-rc1

1.16.0

1.16.0-rc1

1.16.0-rc2

1.16.1

1.16.1-epub-prerelease

1.17.0

1.17.0-rc1

1.18.0

1.18.0-rc1

1.18.1-so-3.10-rc1

1.18.1-so-3.11.12

1.18.1-so-3.11.14

1.18.1-so-3.11.3

1.18.1-so-3.11.4

1.18.1-so-3.12.1-android

1.18.1-so-3.12.1-ios

1.18.1-so-3.12.2b1-android

1.18.1-so-3.12.2b1-ios

1.18.1-so-3.12.4

1.18.1-so-3.12.6

1.19.0

1.19.0-appkit-2.1.0

1.19.0-appkit-2.1.2

1.19.0-rc1

1.19.0-rc1-so-3.12.7

1.19.0-rc2

1.19.0-so-3.13.3

1.19.1

1.2

1.20.0

1.20.0-rc1

1.20.0-rc2

1.20.1

1.20.2

1.20.3

1.21.0

1.21.0-rc1

1.21.1

1.22.0

1.22.0-rc1

1.22.1

1.22.2

1.23.0

1.23.0-rc1

1.23.1

1.23.10

1.23.11

1.23.2

1.23.3

1.23.4

1.23.5

1.23.6

1.23.7

1.23.8

1.23.9

1.24.0

1.24.0-rc1

1.24.1

1.24.10

1.24.11

1.24.2

1.24.3

1.24.4

1.24.5

1.24.6

1.24.7

1.24.8

1.24.9

1.25.0

1.25.0-rc1

1.25.0-rc2

1.25.1

1.25.2

1.25.3

1.25.4

1.25.5

1.25.6

1.26.0

1.26.0-rc1

1.26.0-rc2

1.26.1

1.26.10

1.26.11

1.26.12

1.26.2

1.26.3

1.26.4

1.26.5

1.26.6

1.26.7

1.26.8

1.26.9

1.27.0

1.27.0-rc1

1.27.1

1.27.2

1.3

1.3rc1

1.4

1.4-ios

1.5

1.5-ios

1.5-ios-appstore

1.5-ios-rc6

1.5-ios-rc7

1.5-ios-rc8

1.6

1.6-appstore

1.6-ios-rc1

1.6-ios-rc2

1.7

1.7-rc1

1.7a

1.8

1.8-ios

1.8.1-ios

1.9

1.9-rc1

1.9-rc2

1.9a

Other

android-ice

android-release-60

gsview-0

ios-ice

internal-rf2.*

internal-rf2.4

internal-rf2.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46206.json"