CVE-2025-55780

A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain.

A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain.

A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain.

A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain.

A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain.

A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain.

A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain.

These are all security issues fixed in the mupdf-1.27.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for mupdf fixes the following issues:

Changes in mupdf:

• Build and ship MuPDF as a shared library (make shared=yes) instead of static-only:

  • New subpackage libmupdf27_2 carries libmupdf.so.27.2 (the SONAME tracks the upstream minor.patch version).
  • Replaced the static-only mupdf-devel-static with mupdf-devel, which ships the .so symlink and a generated mupdf.pc (upstream provides no pkg-config file).
  • mupdf-devel obsoletes the dropped mupdf-devel-static so it is cleanly replaced on upgrade (resolves the /usr/include/mupdf header file conflict flagged in staging).

• Consumers that statically embedded libmupdf.a (e.g. zathura's pdf-mupdf plugin) failed to load with "undefined symbol: jpeg_resync_to_restart" because openSUSE builds MuPDF against system codec libraries and the static archive does not pull them in; linking against the shared library (which carries those codecs in its own NEEDED) fixes this (boo#1165273).

• update to 1.27.2:

  • Add ImageMask operation in image rewriter.
  • SText vector merging, and 'fuzzy-vectors' option.
  • SText corruption fixes.
  • SText Depth First Search iterator fixes.

• Update to 1.27.1:

  • Several optimizations, tweaks, and fixes to the structured text device text extraction.
  • Improve table-hunting code in structured text device.
  • Import image-rafting code from layout project to the structured text device.
  • Fix bug causing FitR link destination rectangles to remain untransformed.
  • Fix bug causing xps rendering to enter eternal loop.

• CVE-2025-55780: null pointer dereference occurs in the function break_word_for_overflow_wrap() (bsc#1250443)

• CVE-2026-25556: double-free in fz_fill_pixmap_from_display_list() (bsc#1257944)

• Update to version 1.26.3:

  • Cope with /AS being an indirection in annotations.
  • PDF redaction should honour RO entries.
  • Recompress lossy (JPEG, J2K, JXR, etc) as JPEG when writing to SVG.
  • Improve speed of roll in postscript functions.
  • Be more accepting of EmbeddedFiles FileSpecs.
  • Extend rectangles to improve strikeout detection.
  • Fix strikeout detection failure caused by FP inaccuracy.
  • Make mutool trace and mutool draw -Ftrace output identical.
  • Re-order mutool sub-commands, highlight the most useful commands at the top.
  • Use fz_strstrcase for case insensitive file dialog filters in mupdf-gl.

• Use system brotli, tesseract for builds

• More specific directory globs for files section.

• Update to 1.25.6:

  • Avoid crash when noto fonts have zero size.
  • Fix bug in q/Q count balancing.
  • Improve clip/layer nesting to handle more than 1000 nested levels.
  • Fix bug where all redaction annotations were applied intead of just one.

• Update to 1.25.5:

  • Allow pdf_lookup_page_number_slow on deleted pages.
  • Fix issue in Fax decoder.
  • Tweak antidropout code in the non-AA rasterizer.
  • Fix bug ignoring last entry in UAX 14 line-breaking table.
  • Let Windows handle unhandled ALT-key combinations.
  • Cope with "undersized" cross-reference streams.
  • Use ULL rather than Ui64 in windows specific time funcs
  • Fix redaction problem with form transforms.
  • Fix Makefiles to test/alter CFLAGS, not XCFLAGS.
  • Avoid double drop of fz_html_tree upon exception in xml_to_boxes().
  • Free unopened pages instead of waiting for document to reap them.
  • Do not create bad write options if encrypt option was set to unknown value.
  • PDF saving: Perform a pre-pass to load objects before saving.
  • Change capitalization in mutool usage to be consistent.
  • Ensure that cfb archive entry names are null-terminated.
  • Allocate xml root node in pool.
  • Fix typo in LZW compressed inline image dictionary.
  • Report error in audit tool, otherwise it counts as unhandled.
  • Handle PDF objects numbered outside xref range.
  • Check whether opts is NULL when cleaning a PDF file.
  • Check whether the argument list is NULL, when argument…