CVE-2018-10289: In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file.

Security readout for executives and security teams

CVE-2018-10289 is a denial-of-service issue in MuPDF 1.13.0. A specially crafted PDF can make the parser enter an infinite loop, tying up the application or service that processes it. The source bundle does not show data theft, code execution, or active exploitation. Exposure is most likely where MuPDF 1.13.0, or downstream packages based on it, parse untrusted PDF files. Document preview services, upload pipelines, mail gateways, and desktop PDF workflows may be relevant if they use affected MuPDF builds. Treat this as a service-availability risk, not a confirmed breach risk. Patch externally facing or automated PDF-processing systems first because a malicious file could disrupt business workflows. Mitigation focus: Update MuPDF through the vendor or operating-system distribution guidance.; For Debian LTS, review DLA 2765-1 and apply the relevant security update.; Prioritize systems that parse PDFs from email, uploads, or external users..

Prepared

Jun 7, 2026, 13:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.