PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7563 Artifex CVE debrief

CVE-2016-7563 is a high-severity denial-of-service issue in Artifex MuJS. According to NVD, the chartorune function can perform an out-of-bounds read when a * (asterisk) appears at the end of the input, which can crash or otherwise disrupt the process handling the data. The issue is classified as CWE-125 and is reachable without privileges or user interaction per the CVSS vector.

Vendor
Artifex
Product
Mujs
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Organizations that ship, embed, or depend on Artifex MuJS should care, especially if MuJS is used to process untrusted or externally supplied input. Security teams responsible for application runtimes, document-processing pipelines, or products that parse user-controlled content should prioritize review.

Technical summary

NVD lists this as CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H with CWE-125. The affected area is the chartorune function in MuJS, where an input ending with * can trigger an out-of-bounds read. The primary impact described in the source is denial of service.

Defensive priority

High for exposed or internet-facing deployments that accept untrusted input; moderate for internal-only deployments. The vulnerability is availability-only, but it is reachable without authentication and without user interaction, so exposed parsers should be reviewed promptly.

Recommended defensive actions

  • Identify whether any products, packages, or services include Artifex MuJS.
  • Check whether untrusted input can reach MuJS parsing or tokenization paths, especially around chartorune handling.
  • Upgrade to a vendor-fixed MuJS version if one is available from your supplier or downstream package maintainer.
  • Apply downstream security updates from your OS or application vendor as soon as they are published.
  • If immediate remediation is not possible, reduce exposure by limiting untrusted input paths that invoke MuJS.

Evidence notes

NVD states: affected product Artifex MuJS; weakness CWE-125; CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The supplied description says chartorune allows denial of service via an out-of-bounds read when a * appears at the end of input. The source references include oss-security mailing list posts from 2016-09-21 and 2016-09-28 and a Ghostscript bug tracker entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7563 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7563

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7563 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7563

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.