CVE-2017-17866

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-12-27 · updated 2026-06-17
Weakness: CWE-119

Description

pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document.

Affected products

Artifex MuPDF: before 1.12.0 — fixed in 1.12.0
Debian Linux: 9.0

How to fix

Upgrade to a fixed version: Artifex MuPDF 1.12.0. Check the vendor advisory for mitigations.

References

http://www.ghostscript.com/cgi-bin/findgit.cgi?520cc26d18c9ee245b56e9e91f9d4fcae02be5f0
https://bugs.ghostscript.com/show_bug.cgi?id=698699
https://www.debian.org/security/2018/dsa-4334
http://www.ghostscript.com/cgi-bin/findgit.cgi?520cc26d18c9ee245b56e9e91f9d4fcae02be5f0
https://bugs.ghostscript.com/show_bug.cgi?id=698699
https://www.debian.org/security/2018/dsa-4334

Get alerted when CVE-2017-17866 or the next vulnerability affects your stack