landw-hub/cve-2025-46206CVE-2025-46206 proof-of-concept demonstrating a denial-of-service vulnerability in MuPDF 1.25.6 via infinite recursion in pdf-clean-file.c, with reproduction steps and vendor patch.
There is a denial of service vulnerability in MuPDF 1.25.6 and earlier versions. When an attacker runs the "mutool clean poc /dev/null" command, the program will fall into an infinite recursion between the strip_outlines() and strip_outline() functions in pdf-clean-file.c until the stack is exhausted.
See the attachment for the specific POC file, vulnerability cause, reproduction process and repair suggestions.
The vendor (Artifex Software, maintainer of MuPDF) has acknowledged the issue and fixed the bug. The fix has been committed in their official repository.
Here is the public link to the patch / commit provided by the vendor:
https://bugs.ghostscript.com/show_bug.cgi?id=708521
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0ec7e4d2201bb6df217e01c17396d36297abf9ac
This confirms that the vulnerability has been acknowledged and remediated.
MuPDF 1.25.6 及更早版本存在拒绝服务漏洞。当攻击者运行“mutool clean poc /dev/null”命令时，程序会在 pdf-clean-file.c 文件中的 strip_outlines() 和 strip_outline() 函数之间陷入无限递归，直至堆栈耗尽。
请参阅附件，了解具体的 POC 文件、漏洞原因、复现步骤和修复建议。
供应商（MuPDF 的维护者 Artifex Software）已确认此问题并修复了该漏洞。修复程序已提交到其官方代码库。
以下是供应商提供的补丁/提交的公开链接：
https://bugs.ghostscript.com/show_bug.cgi?id=708521
这证实了该漏洞已被确认并已修复。
