CVE-2025-71382

MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71382.json"
}

References

Affected packages

Git / github.com/artifexsoftware/mupdf

Affected ranges

Type

GIT

Repo

https://github.com/artifexsoftware/mupdf

Events

Introduced

Fixed

d3b7556577b790e9761868c314ad6fd9b6dd86a9

Fixed

70b71ab22e6de4d4c44cd301c88231f623a4e94e

Fixed

9d419fc6d9e4caa46e15d8e5d313b2d57c61bfa7

Database specific

Show details

{
    "cpe": "cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.27.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.*

1.0

1.0rc1

1.1-forms-tech-preview

1.10

1.10-rc1

1.10-rc2

1.11

1.11-rc1

1.11.1

1.12.0

1.13.0

1.13.0-rc1

1.14.0

1.14.0-rc1

1.15.0

1.15.0-rc1

1.16.0

1.16.0-rc1

1.16.0-rc2

1.16.1

1.16.1-epub-prerelease

1.17.0-rc1

1.18.0

1.18.0-rc1

1.18.1-so-3.12.1-android

1.18.1-so-3.12.1-ios

1.18.1-so-3.12.2b1-android

1.18.1-so-3.12.2b1-ios

1.18.1-so-3.12.4

1.18.1-so-3.12.6

1.19.0-rc1

1.19.0-rc1-so-3.12.7

1.2

1.20.0-rc1

1.21.0-rc1

1.22.0-rc1

1.23.0

1.23.0-rc1

1.24.0

1.24.0-rc1

1.25.0-rc1

1.26.0-rc1

1.26.0-rc2

1.27.0-rc1

1.3rc1

1.4

1.4-ios

1.5

1.5-ios

1.5-ios-appstore

1.5-ios-rc6

1.5-ios-rc7

1.5-ios-rc8

1.6

1.6-appstore

1.6-ios-rc1

1.6-ios-rc2

1.7

1.7-rc1

1.7a

1.8

1.9

1.9-rc1

1.9-rc2

1.9a

Other

android-release-60

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71382.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "249366329110280250880974292642454899873",
                "298452772998204583741315718998804186654",
                "246665099913006885487427977143869501424",
                "226495033384969031390017779327972361606",
                "338425939486695600720550229561831337622",
                "101994744914548263347964358038402681842",
                "194120624966045279999943932332826407259",
                "64840780113404501749665532905197575667",
                "311802052120347122654801284142787809768",
                "160447079547790859635261672673514929672",
                "66500399548634781989633676588608957720",
                "127697111726199351237263438510803827579"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-71382-2aec4753",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/artifexsoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94e",
        "target": {
            "file": "source/html/css-apply.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "211028717704414794691558675982010287858",
            "length": 284
        },
        "id": "CVE-2025-71382-5d7eb8fc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/artifexsoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94e",
        "target": {
            "file": "source/html/css-apply.c",
            "function": "value_from_inheritable_property"
        }
    }
]

vanir_signatures_modified

"2026-08-12T15:15:01Z"