CVE-2018-1000040

Public Exploit

Description

In Artifex MuPDF 1.12.0 and earlier, multiple use of uninitialized value bugs in the PDF parser could allow an attacker to cause a denial of service (crash) or influence program flow via a crafted file.

Category

5.5
CVSS
Severity: Medium
CVSS 3.0 •
CVSS 2.0 •
EPSS 0.26%
Vendor Advisory gentoo.org Vendor Advisory debian.org
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
https://security.gentoo.org/glsa/201811-15 third party advisory vendor advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5596 issue tracking exploit
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5600 issue tracking exploit
https://www.debian.org/security/2018/dsa-4334 third party advisory vendor advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5610 issue tracking exploit
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5609 issue tracking patch exploit third party advisory
http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=83d4dae44c71816c084a635550acc1a51529b881%3Bhp=f597300439e62f5e921f0d7b1e880b5c1a1f1607
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5603 issue tracking exploit
https://bugs.ghostscript.com/show_bug.cgi?id=699086
https://bugs.ghostscript.com/show_bug.cgi?id=698904
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=ace9e69017c08e1e4ce5912014177414c0382004

Frequently Asked Questions

What is the severity of CVE-2018-1000040?
CVE-2018-1000040 has been scored as a medium severity vulnerability.
How to fix CVE-2018-1000040?
To fix CVE-2018-1000040, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2018-1000040 being actively exploited in the wild?
It is possible that CVE-2018-1000040 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.