{"id":"CVE-2021-4216","aliases":["DEBIAN-CVE-2021-4216","EUVD-2021-34074","GHSA-fxg7-4q6m-p84h","UBUNTU-CVE-2021-4216","openSUSE-SU-2022:10125-1","openSUSE-SU-2022:10126-1","openSUSE-SU-2024:12326-1"],"status":"published","title":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in...","description":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00247,"percentile":0.16125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-369"],"published":"2022-08-26T15:25:43Z","modified":"2026-10-23T18:05:23Z","fixes":[{"ecosystem":"Debian:12","package":"mupdf","fixed_in":["1.20.0+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mupdf","fixed_in":["1.20.0+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mupdf","fixed_in":["1.20.0+ds1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"mupdf","fixed_in":["1.12.0-bp153.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"mupdf","fixed_in":["1.12.0-bp153.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mupdf","fixed_in":["1.20.3-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0+ds1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7-1","1.7a-1","1.7a-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11+ds1-1.1","1.11+ds1-2","1.12.0+ds1-1","1.12.0+ds1-1ubuntu0.1~esm1","1.12.0+ds1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0+ds1-1","1.16.1+ds1-1ubuntu1","1.16.1+ds1-1ubuntu1+esm1","1.16.1+ds1-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.0+ds1-2","1.19.0+ds1-1","1.19.0+ds1-1build1","1.19.0+ds1-2","1.19.0+ds1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-bp153.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-bp153.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-2.1"}]}]}],"products":[{"vendor":"artifex","product":"mupdf"}],"references":[{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=704834","tags":["x_refsource_MISC","x_transferred","Permissions Required","report"]},{"url":"https://github.com/ArtifexSoftware/mupdf/commit/22c47acbd52949421f8c7cb46ea1556827d0fcbf","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4216"},{"url":"https://github.com/advisories/GHSA-fxg7-4q6m-p84h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4216","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-4216","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4216","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HOB6LS4J7NNBI7QSCZO47TN6B7O6WKCI/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202858","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4216","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3URMJJJ2MKM4FNDYFMSSIEJDTNENDZRU/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-25032","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-4216","description":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.","status":"published","published":"2022-08-26T15:25:43Z","modified":"2024-08-03T17:16:04.307Z","cwes":["CWE-369"],"updated_at":"2026-11-02T14:33:07.697752Z"}],"euvd":[{"id":"EUVD-2021-34074","description":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.","status":"published","published":"2022-08-26T15:25:43Z","modified":"2024-08-03T17:16:04Z","updated_at":"2026-11-03T03:25:10.418596Z"}],"ghsa":[{"id":"GHSA-fxg7-4q6m-p84h","title":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in...","description":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.","status":"published","published":"2022-08-27T00:00:45Z","modified":"2023-01-29T05:01:46Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:44:54.907829Z"}],"nvd":[{"id":"CVE-2021-4216","description":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.","status":"published","published":"2022-08-26T16:15:09.82Z","modified":"2026-06-17T04:19:14.13Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-4216","description":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.","status":"published","published":"2022-08-26T16:15:09.82Z","modified":"2026-10-20T14:08:53.11117106Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-4216","description":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.","status":"published","published":"2022-08-26T16:15:09.82Z","modified":"2026-10-23T18:05:23.124235259Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"UBUNTU-CVE-2021-4216","description":"A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.","status":"published","published":"2022-08-26T16:15:00Z","modified":"2026-04-22T13:01:46.166033Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"openSUSE-SU-2022:10125-1","title":"Security update for mupdf","description":"This update for mupdf fixes the following issues:\n\n- CVE-2021-4216: Fixed division by zero for zero width pages in muraster (boo#1202858) \n","status":"published","published":"2022-09-17T16:01:33Z","modified":"2026-02-04T04:07:58.675913Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10126-1","title":"Security update for mupdf","description":"This update for mupdf fixes the following issues:\n\nmupdf was updated to 1.20.3:\n\n* return error, not success when unable to lock native device resource.\n* Bug 705620: Start journal operation instead of pushing local xref.\n* Ensure AndroidDrawDevice is destroyed, even upon exception.\n* source/pdf/pdf-clean.c: fix segv from incorrect call to fz_drop_pixmap().\n* Bug 705681: Enclose code in begin/end operation.\n* Guard against SEGVs when calling archive functions with NULL archive.\n\nmupdf was updated to 1.20.0 (boo#1202858, CVE-2021-4216):\n\n* Experimental C# bindings\n* Cross compilation should no longer need a host compiler\n* Major additions to JNI bindings\n* New API to edit outline\n* New API to resolve and create links\n* New API to toggle individual layers in PDF\n* Layer panel in mupdf-gl\n* Layer option in mutool draw\n* New API to add a Javascript console\n* Console panel in mupdf-gl\n* Text search API extended to be able to distinguish between separate search hits\n* Command line tool improvements:\n* all: Negative page numbers to index from the last page\n* mutool draw: Add option to render document without text\n* mutool draw and convert: Support DPI option in text and HTML output\n* New hybrid HTML output format using 'scripts/pdftohtml' script:\n* Graphics in a background image\n* Text on top\n* Improved WASM viewer demo\n* Support high DPI screens\n* Progressive loading\n* Update to zlib 1.2.12 for security fix \n\nmupdf was updated to 1.19.1:\n\n* Updated zlib to 1.2.12 due to CVE-2018-25032\n","status":"published","published":"2022-09-17T18:01:24Z","modified":"2026-02-04T03:26:38.660732Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12326-1","title":"mupdf-1.20.3-2.1 on GA media","description":"These are all security issues fixed in the mupdf-1.20.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:19:43.305597Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}