CVE-2018-16648

Name of the Vulnerable Software and Affected Versions Artifex MuPDF version 1.13.0

Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault, by providing a crafted pdf file. This is due to an array-index underflow in the pdf dev alpha array in pdf/pdf-device.c.

Recommendations For Artifex MuPDF version 1.13.0, consider avoiding the use of the fz append byte function in fitz/buffer.c until a patch is available. As a temporary workaround, restrict the processing of crafted pdf files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.