PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7563 Artifex CVE debrief

CVE-2016-7563 is a high-severity denial-of-service issue in Artifex MuJS. According to NVD, the chartorune function can perform an out-of-bounds read when a * (asterisk) appears at the end of the input, which can crash or otherwise disrupt the process handling the data. The issue is classified as CWE-125 and is reachable without privileges or user interaction per the CVSS vector.

Vendor
Artifex
Product
CVE-2016-7563
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Organizations that ship, embed, or depend on Artifex MuJS should care, especially if MuJS is used to process untrusted or externally supplied input. Security teams responsible for application runtimes, document-processing pipelines, or products that parse user-controlled content should prioritize review.

Technical summary

NVD lists this as CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H with CWE-125. The affected area is the chartorune function in MuJS, where an input ending with * can trigger an out-of-bounds read. The primary impact described in the source is denial of service.

Defensive priority

High for exposed or internet-facing deployments that accept untrusted input; moderate for internal-only deployments. The vulnerability is availability-only, but it is reachable without authentication and without user interaction, so exposed parsers should be reviewed promptly.

Recommended defensive actions

  • Identify whether any products, packages, or services include Artifex MuJS.
  • Check whether untrusted input can reach MuJS parsing or tokenization paths, especially around chartorune handling.
  • Upgrade to a vendor-fixed MuJS version if one is available from your supplier or downstream package maintainer.
  • Apply downstream security updates from your OS or application vendor as soon as they are published.
  • If immediate remediation is not possible, reduce exposure by limiting untrusted input paths that invoke MuJS.

Evidence notes

NVD states: affected product Artifex MuJS; weakness CWE-125; CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The supplied description says chartorune allows denial of service via an out-of-bounds read when a * appears at the end of input. The source references include oss-security mailing list posts from 2016-09-21 and 2016-09-28 and a Ghostscript bug tracker entry.

Official resources

The CVE record was published on 2017-01-18. The supplied references indicate public discussion in oss-security in September 2016, with the CVE assigned and published later by the CVE program and NVD.