{"id":"CVE-2025-55780","aliases":["DEBIAN-CVE-2025-55780","EUVD-2025-30899","GHSA-756h-grq9-2jvh","UBUNTU-CVE-2025-55780","openSUSE-SU-2026:10214-1","openSUSE-SU-2026:21180-1"],"status":"published","title":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4...","description":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node-\u003enext is valid before accessing node-\u003enext-\u003eoverflow_wrap, resulting in a crash if the split fails or returns a partial node chain.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00428,"percentile":0.37334,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-476"],"published":"2025-09-23T00:00:00Z","modified":"2026-11-05T23:10:00Z","exploits":[{"source":"pocgithub","id":"ISH2YU/CVE-2025-55780","title":"ISH2YU/CVE-2025-55780","date":"2025-09-24","url":"https://github.com/ISH2YU/CVE-2025-55780"}],"fixes":[{"ecosystem":"Debian:14","package":"mupdf","fixed_in":["1.27.0+ds1-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1+ds2-1","1.21.1+ds2-1+deb12u1","1.22.1+ds1-1","1.22.2+ds1-1","1.22.2+ds1-2","1.23.10+ds1-1","1.23.10+ds1-2","1.23.6+ds1-1","1.23.7+ds1-1","1.24.10+ds1-1","1.24.3+ds1-1","1.24.8+ds2-1","1.24.8+ds2-2","1.24.9+ds1-1","1.25.1+ds1-1","1.25.1+ds1-2","1.25.1+ds1-3","1.25.1+ds1-4","1.25.1+ds1-5","1.25.1+ds1-6","1.25.1+ds1-7","1.25.1+ds1-8","1.25.1+ds1-9","1.27.0+ds1-1","1.27.0+ds1-2","1.27.0+ds1-3","1.27.0+ds1-4","1.27.0+ds1-5","1.27.0+ds1-6","1.28.0+ds1-1","1.28.2+ds1-1","1.28.2+ds1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.1+ds1-6","1.25.1+ds1-6+deb13u1","1.25.1+ds1-7","1.25.1+ds1-8","1.25.1+ds1-9","1.27.0+ds1-1","1.27.0+ds1-2","1.27.0+ds1-3","1.27.0+ds1-4","1.27.0+ds1-5","1.27.0+ds1-6","1.28.0+ds1-1","1.28.2+ds1-1","1.28.2+ds1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0+ds1-2"}]}],"versions":["1.25.1+ds1-6","1.25.1+ds1-7","1.25.1+ds1-8","1.25.1+ds1-9","1.27.0+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7-1","1.7a-1","1.7a-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11+ds1-1.1","1.11+ds1-2","1.12.0+ds1-1","1.12.0+ds1-1ubuntu0.1~esm1","1.12.0+ds1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0+ds1-1","1.16.1+ds1-1ubuntu1","1.16.1+ds1-1ubuntu1+esm1","1.16.1+ds1-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.0+ds1-2","1.19.0+ds1-1","1.19.0+ds1-1build1","1.19.0+ds1-2","1.19.0+ds1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2+ds1-2","1.22.2+ds1-2build1","1.23.6+ds1-1","1.23.7+ds1-1","1.23.10+ds1-1","1.23.10+ds1-1build1","1.23.10+ds1-1build2","1.23.10+ds1-1build3","1.23.10+ds1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.1+ds1-5build2","1.25.1+ds1-6","1.25.1+ds1-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27.0+ds1-3ubuntu2","1.27.0+ds1-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.1+ds1-7","1.25.1+ds1-7build1","1.25.1+ds1-7build2","1.27.0+ds1-2ubuntu1","1.27.0+ds1-3ubuntu1","1.27.0+ds1-3ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mupdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"artifex","product":"mupdf"}],"references":[{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=708720","tags":["Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://github.com/ISH2YU/CVE-2025-55780/tree/main","tags":["Third Party Advisory","web"]},{"url":"https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=bdd5d241748807378a78a622388e0312332513c5","tags":["Permissions Required","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55780","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-756h-grq9-2jvh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55780.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-55780","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-55780","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55780","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25556","tags":["web"]},{"url":"https://bugzilla.suse.com/1165273","tags":["report"]},{"url":"https://bugzilla.suse.com/1250443","tags":["report"]},{"url":"https://bugzilla.suse.com/1257944","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-55780","description":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node-\u003enext is valid before accessing node-\u003enext-\u003eoverflow_wrap, resulting in a crash if the split fails or returns a partial node chain.","status":"published","published":"2025-09-23T00:00:00Z","modified":"2025-09-25T14:47:03.426Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-30899","description":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node-\u003enext is valid before accessing node-\u003enext-\u003eoverflow_wrap, resulting in a crash if the split fails or returns a partial node chain.","status":"published","published":"2025-09-23T00:00:00Z","modified":"2025-09-25T14:47:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:39.520931Z"}],"ghsa":[{"id":"GHSA-756h-grq9-2jvh","title":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4...","description":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node-\u003enext is valid before accessing node-\u003enext-\u003eoverflow_wrap, resulting in a crash if the split fails or returns a partial node chain.","status":"published","published":"2025-09-23T18:30:26Z","modified":"2025-09-25T15:30:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:03:45.893243Z"}],"nvd":[{"id":"CVE-2025-55780","description":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node-\u003enext is valid before accessing node-\u003enext-\u003eoverflow_wrap, resulting in a crash if the split fails or returns a partial node chain.","status":"published","published":"2025-09-23T18:15:34.743Z","modified":"2026-11-05T23:10:00.15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-06T01:57:37.498693Z"}],"osv":[{"id":"CVE-2025-55780","description":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node-\u003enext is valid before accessing node-\u003enext-\u003eoverflow_wrap, resulting in a crash if the split fails or returns a partial node chain.","status":"published","published":"2025-09-23T00:00:00Z","modified":"2026-11-07T07:06:48.57646656Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T03:07:57.67871Z"},{"id":"DEBIAN-CVE-2025-55780","description":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node-\u003enext is valid before accessing node-\u003enext-\u003eoverflow_wrap, resulting in a crash if the split fails or returns a partial node chain.","status":"published","published":"2025-09-23T18:15:34.743Z","modified":"2026-09-01T20:05:54.506238688Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-55780","description":"A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node-\u003enext is valid before accessing node-\u003enext-\u003eoverflow_wrap, resulting in a crash if the split fails or returns a partial node chain.","status":"published","published":"2025-09-23T18:15:00Z","modified":"2026-10-17T12:57:08.552168623Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"openSUSE-SU-2026:10214-1","title":"mupdf-1.27.1-1.1 on GA media","description":"These are all security issues fixed in the mupdf-1.27.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-17T00:00:00Z","modified":"2026-03-23T04:54:35.208626Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:21180-1","title":"Security update for mupdf","description":"This update for mupdf fixes the following issues:\n\nChanges in mupdf:\n\n- Build and ship MuPDF as a shared library (make shared=yes) instead of\n  static-only:\n  * New subpackage libmupdf27_2 carries libmupdf.so.27.2 (the SONAME\n    tracks the upstream minor.patch version).\n  * Replaced the static-only mupdf-devel-static with mupdf-devel, which\n    ships the .so symlink and a generated mupdf.pc (upstream provides no\n    pkg-config file).\n  * mupdf-devel obsoletes the dropped mupdf-devel-static so it is\n    cleanly replaced on upgrade (resolves the /usr/include/mupdf\n    header file conflict flagged in staging).\n- Consumers that statically embedded libmupdf.a (e.g. zathura's\n  pdf-mupdf plugin) failed to load with \"undefined symbol:\n  jpeg_resync_to_restart\" because openSUSE builds MuPDF against system\n  codec libraries and the static archive does not pull them in; linking\n  against the shared library (which carries those codecs in its own\n  NEEDED) fixes this (boo#1165273).\n\n- update to 1.27.2:\n  * Add ImageMask operation in image rewriter.\n  * SText vector merging, and 'fuzzy-vectors' option.\n  * SText corruption fixes.\n  * SText Depth First Search iterator fixes.\n\n- Update to 1.27.1:\n  * Several optimizations, tweaks, and fixes to the structured text\n    device text extraction.\n  * Improve table-hunting code in structured text device.\n  * Import image-rafting code from layout project to the structured\n    text device.\n  * Fix bug causing FitR link destination rectangles to remain\n    untransformed.\n  * Fix bug causing xps rendering to enter eternal loop.\n- CVE-2025-55780: null pointer dereference occurs in the function\n  break_word_for_overflow_wrap() (bsc#1250443)\n- CVE-2026-25556: double-free in fz_fill_pixmap_from_display_list()\n  (bsc#1257944)\n\n- Update to version 1.26.3:\n  * Cope with /AS being an indirection in annotations.\n  * PDF redaction should honour RO entries.\n  * Recompress lossy (JPEG, J2K, JXR, etc) as JPEG when writing to\n    SVG.\n  * Improve speed of roll in postscript functions.\n  * Be more accepting of EmbeddedFiles FileSpecs.\n  * Extend rectangles to improve strikeout detection.\n  * Fix strikeout detection failure caused by FP inaccuracy.\n  * Make mutool trace and mutool draw -Ftrace output identical.\n  * Re-order mutool sub-commands, highlight the most useful\n    commands at the top.\n  * Use fz_strstrcase for case insensitive file dialog filters in\n    mupdf-gl.\n- Use system brotli, tesseract for builds\n- More specific directory globs for files section.\n\n- Update to 1.25.6:\n  * Avoid crash when noto fonts have zero size.\n  * Fix bug in q/Q count balancing.\n  * Improve clip/layer nesting to handle more than 1000 nested levels.\n  * Fix bug where all redaction annotations were applied intead of just one.\n\n- Update to 1.25.5:\n  * Allow pdf_lookup_page_number_slow on deleted pages.\n  * Fix issue in Fax decoder.\n  * Tweak antidropout code in the non-AA rasterizer.\n  * Fix bug ignoring last entry in UAX 14 line-breaking table.\n  * Let Windows handle unhandled ALT-key combinations.\n  * Cope with \"undersized\" cross-reference streams.\n  * Use ULL rather than Ui64 in windows specific time funcs\n  * Fix redaction problem with form transforms.\n  * Fix Makefiles to test/alter CFLAGS, not XCFLAGS.\n  * Avoid double drop of fz_html_tree upon exception in xml_to_boxes().\n  * Free unopened pages instead of waiting for document to reap them.\n  * Do not create bad write options if encrypt option was set to unknown value.\n  * PDF saving: Perform a pre-pass to load objects before saving.\n  * Change capitalization in mutool usage to be consistent.\n  * Ensure that cfb archive entry names are null-terminated.\n  * Allocate xml root node in pool.\n  * Fix typo in LZW compressed inline image dictionary.\n  * Report error in audit tool, otherwise it counts as unhandled.\n  * Handle PDF objects numbered outside xref range.\n  * Check whether opts is NULL when cleaning a PDF file.\n  * Check whether the argument list is NULL, when argument are said to exist.\n  * Consistently use uint32_t for color in stext device.\n  * Sync open page numbers after undo has swapped the xrefs, not before.\n  * Clear the in-doc flag when removing a page from the opened page list.\n  * Add support archive script to create commercial tarballs.\n\n- Update to 1.25.4:\n  * Add common Noto font name lookup function.\n  * Improve font Ascent/Descent handling.\n  * Allow fz_store_size to be customised in Java.\n  * Add fz_atoz() convenience function to parse size_t.\n  * Add and use convenience function for loading user CSS.\n  * Fix valgrind error seen with saving pdfs with garbage collection.\n  * Process both widgets and annotations when rewriting images.\n  * Adjust vector handling in page segmentation.\n  * Only include latest object versions when gathering object streams.\n  * Add AFRelationship property.\n  * Minimise size of softmasks before rendering.\n  * Fix bug where mutool clean produced object 0 with invalid gen num.\n  * Fix bbox calculation in segmentation.\n  * Improve exception messages from tesseract.\n  * When deleting widget fields, compare the objects, not their pointers.\n  * Fix for JBIG2 data not having the correct filter attached.\n  * Fix concerning renumbered PDF encryption dictionaries.\n\n- Update to 1.25.3:\n  * Fix bug where structure trees were always kept.\n  * Add option to drop/keep structure trees when rearranging or subsetting pages.\n\n- Update to 1.25.2:\n  * Add support to spot invisible text in structured text.\n  * Fix sanitisation of clipping paths.\n  * Fix leak in C++ wrappers.\n\n- Update to 1.25.1:\n  * Fix bug in structured text to html conversion concerning color.\n\n- For changes in 1.25.0 and older see https://mupdf.com/releases/history\n\n- Update to 1.24.10:\n  * Several fixes to python scripts for bindings.\n  * Fix bug relating to redactions on pages with shared content\n    streams.\n  * Fix bug when both color keying and softmasking is used.\n","status":"published","published":"2026-06-30T11:34:14Z","modified":"2026-07-02T18:24:19.904453189Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}