CVE-2009-4117: Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before commit 20091125231942, as used in Sum...

Security readout for executives and security teams

CVE-2009-4117 is an old PDF parsing flaw in MuPDF, also affecting SumatraPDF before 1.0.1. A malicious PDF could crash the viewer and may allow code execution. Business urgency is highest where legacy PDF viewers, embedded MuPDF libraries, or untracked third-party PDF processing remain in use. Exposure is most likely in legacy SumatraPDF before 1.0.1, old MuPDF builds, or applications embedding MuPDF code from before the 2009 fix. Modern maintained builds are less likely affected, but embedded copies may persist in products, appliances, or document-processing workflows. Treat this as a legacy-software cleanup priority. It is not listed as actively exploited in the provided sources, but the potential impact is serious if vulnerable PDF software processes untrusted documents. Focus on asset discovery, embedded dependencies, and replacement of unsupported builds. Mitigation focus: Upgrade SumatraPDF to 1.0.1 or later where applicable.; Update MuPDF to a build containing the referenced 2009 fixes.; Identify applications embedding MuPDF and request vendor confirmation..

Prepared

Jun 28, 2026, 12:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.