CVE-2026-92413 Artifex CVE debrief

Who should care

Defenders responsible for systems using Artifex MuPDF, especially those exposed to remote access, should assess their exposure and prioritize patching. This includes operators, platforms, vulnerability-management, and security teams that may be impacted by the vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through a a

Why it matters

CVE-2026-92413 is a null pointer dereference vulnerability in Artifex MuPDF's PDF Xref Loading component. Defenders should prioritize patching vulnerable systems, especially those exposed to remote access, and verify their inventory of systems using Artifex MuPDF.

• Remote exploitation of vulnerable systems
• Potential for denial-of-service or system crashes
• Need for patching and verification of vulnerable systems
• Possible impact on system availability

Technical summary

The vulnerability exists in the pdf_open_filter function of the pdf-stream.c file in Artifex MuPDF up to version b6d17493700c621c0e70036980a6ebd06d2202c9. A remote attacker can exploit this issue to cause a null pointer dereference. The vulnerability can lead to a denial-of-service or system crashes, and defenders should prioritize patching vulnerable systems, especially those exposed to remote access. The affected product context requires verification of systems using Artifex MuPDF, and the defensive impact involves prioritizing patching and verifying inventory.

Defensive priority

Defenders should prioritize patching vulnerable systems, especially those exposed to remote access.

Recommended defensive actions

• Apply the provided patch (3df1e30f9d7b77260e13bd0dbe1928ddeba8386e) to vulnerable systems
• Verify and update inventory of systems using Artifex MuPDF
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the exact scope of affected systems and potential impact require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.