CVE-2019-13290

Name of the Vulnerable Software and Affected Versions Artifex MuPDF version 1.15.0

Description The issue is a heap-based buffer overflow in the fz append display node function, located at fitz/list-device.c, which allows remote attackers to execute arbitrary code via a crafted PDF file. This occurs when a large BDC property name overflows the allocated size of a display list node.

Recommendations For Artifex MuPDF version 1.15.0, consider disabling the fz append display node function until a patch is available to prevent exploitation. Avoid using the affected function to process crafted PDF files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.