CVE-2018-1000036
In MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a...
In Artifex MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
5.5
In Artifex MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.
- Record
CVE-2018-1000036- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-772
- Updated
- 2026-11-02
CVE List No score
In Artifex MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.
- Record
CVE-2018-1000036- Updated
- 2026-11-02
EUVDEUVD-2018-1797 No score
In Artifex MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.
- Record
EUVD-2018-1797- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cqwp-8vf4-jg4p
5.5
In MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a...
In MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.
- Record
GHSA-cqwp-8vf4-jg4p- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-772
- Updated
- 2026-11-02
OSV
5.5
In Artifex MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.
- Record
CVE-2018-1000036- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1000036
5.5
In Artifex MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.
- Record
DEBIAN-CVE-2018-1000036- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000036
5.5
In Artifex MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.
- Record
UBUNTU-CVE-2018-1000036- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-7825-1 No score
mupdf vulnerabilities
It was discovered that MuPDF incorrectly managed memory, resulting in a memory leak. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-1000036)
It was discovered that MuPDF could enter an infinite loop when parsing certain PDF files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10289)
It was discovered that MuPDF incorrectly managed memory, possibly leading to a segmentation fault. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-16647, CVE-2018-16648)
It was discovered that MuPDF contained a use-after-free vulnerability. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-21896)
It was discovered that MuPDF incorrectly managed memory, resulting in a memory leak. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-26683)
Maxim Mishechkin, Vitalii Akolzin, Shamil Kurmangaleev, Denis Straghkov, Fedor Nis'kov and Ivan Gulakov discovered that MuPDF incorrectly managed memory under certain circumstances, leading to a double-free. An attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3407)
Xuwei Liu discovered that MuPDF may perform an out-of-bounds write under certain circumstances. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-37220)
- Record
USN-7825-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mupdfDebian:12 |
before 1.14.0+ds1-1 | 1.14.0+ds1-1 |
mupdfDebian:13 |
before 1.14.0+ds1-1 | 1.14.0+ds1-1 |
mupdfDebian:14 |
before 1.14.0+ds1-1 | 1.14.0+ds1-1 |
mupdfDebian:9 |
before 1.14.0+ds1-4+deb9u1, plus listed versions 1.11+ds1-11.11+ds1-1.11.11+ds1-21.12.0+ds1-11.13.0+ds1-1 Show 14 moreShow less1.13.0+ds1-21.13.0+ds1-31.14.0+ds1-11.14.0+ds1-21.14.0+ds1-31.14.0+ds1-41.9a+ds1-41.9a+ds1-4+deb9u11.9a+ds1-4+deb9u21.9a+ds1-4+deb9u31.9a+ds1-4+deb9u41.9a+ds1-4+deb9u51.9a+ds1-4+deb9u61.9a+ds1-4+deb9u7 |
1.14.0+ds1-4+deb9u1 |
mupdfUbuntu:Pro:18.04:LTS |
before 1.12.0+ds1-1ubuntu0.1~esm1, plus listed versions 1.11+ds1-1.11.11+ds1-21.12.0+ds1-1 |
1.12.0+ds1-1ubuntu0.1~esm1 |
mupdfUbuntu:Pro:16.04:LTS |
before 1.7a-1ubuntu0.1~esm1, plus listed versions 1.7-11.7a-1 |
1.7a-1ubuntu0.1~esm1 |
mupdfUbuntu:Pro:20.04:LTS |
before 1.16.1+ds1-1ubuntu1+esm1, plus listed versions 1.15.0+ds1-11.16.1+ds1-1ubuntu1 |
1.16.1+ds1-1ubuntu1+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000036 is a medium vulnerability (CVSS 5.5) in Artifex Mupdf, published May 24, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 61st percentile. Fixed in mupdf 1.14.0+ds1-1.
References
bugs.chromium.org/p/oss-fuzz/issues/detail?id=5502
security.gentoo.org/glsa/201811-15
lists.debian.org/debian-lts-announce/2021/09/msg00013.html
bugs.ghostscript.com/show_bug.cgi?id=698887
cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit?id=8aa2bd34065d2844aae778bd4cc20c74bbcd9406
nvd.nist.gov/vuln/detail/CVE-2018-1000036
Show 12 moreShow less
github.com/advisories/GHSA-cqwp-8vf4-jg4p
security-tracker.debian.org/tracker/CVE-2018-1000036
ubuntu.com/security/CVE-2018-1000036
cve.org/CVERecord?id=CVE-2018-1000036
ubuntu.com/security/notices/USN-7825-1
ubuntu.com/security/CVE-2018-10289
ubuntu.com/security/CVE-2018-16647
ubuntu.com/security/CVE-2018-16648
ubuntu.com/security/CVE-2020-21896
ubuntu.com/security/CVE-2020-26683
ubuntu.com/security/CVE-2021-3407
ubuntu.com/security/CVE-2021-37220