CVE-2017-5991: An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465.

Security readout for executives and security teams

MuPDF could crash when processing a specially crafted PDF because of a NULL pointer dereference during XObject rendering. Business impact is mainly availability for applications or workflows that parse untrusted PDFs, such as document preview, conversion, indexing, or security scanning. Sources state MuPDF 1.11 and later are unaffected. Exposure is most likely where older MuPDF libraries or tools process PDFs from users, email, web uploads, archives, or automated content pipelines. The source bundle does not enumerate affected downstream applications, so embedded copies must be checked locally. Prioritize remediation for internet-facing or high-volume PDF processing systems. For isolated desktop-only use, urgency is lower but still worth addressing because public exploit information is referenced and the fix path is old and well established. Mitigation focus: Upgrade MuPDF to version 1.11 or later where possible.; Apply vendor packages referenced by Debian or Gentoo advisories if using those distributions.; Inventory applications that bundle MuPDF rather than relying only on system packages..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.