CVE-2025-71382: MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering
MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function valuefrominheritableproperty() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71382?
The severity of CVE-2025-71382 is rated as medium with a score of 6.5.
How do I fix CVE-2025-71382?
To mitigate CVE-2025-71382, upgrade to MuPDF version 1.27.0-rc1 or later.
What types of attacks does CVE-2025-71382 enable?
CVE-2025-71382 enables remote attackers to cause a denial of service through stack exhaustion by exploiting the EPUB CSS rendering.
What version of MuPDF is affected by CVE-2025-71382?
MuPDF versions prior to 1.27.0-rc1 are affected by CVE-2025-71382.
What is the risk level associated with CVE-2025-71382?
CVE-2025-71382 has a risk level of 37, indicating a significant potential impact.