PatchSiren

Artifex Software Inc. *PyMuPDF* CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Artifex Software Inc. *PyMuPDF* CVE published 2026-03-31

CVE-2026-3308

CVE-2026-3308 is an integer overflow vulnerability in MuPDF's 'pdf-image.c' that allows for arbitrary code execution via a crafted PDF. The vulnerability is rated HIGH with a CVSS score of 7.8. MuPDF version 1.27.0 is affected. An attacker can exploit this vulnerability by crafting a PDF that triggers an integer overflow within the 'pdf_load_image_imp' function, leading to a heap out-of-bounds write. The [truncated]