CVE-2019-13290: Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device...

Security readout for executives and security teams

This CVE is a memory corruption flaw in Artifex MuPDF 1.15.0. A malicious PDF could trigger a heap buffer overflow and potentially run code in the context of the PDF-rendering process. Business urgency depends on whether MuPDF processes untrusted PDFs in user endpoints, servers, document pipelines, or embedded applications. Exposure is most likely where Artifex MuPDF 1.15.0, or downstream distro packages containing the vulnerable code, renders untrusted PDFs. This includes desktop viewers, automated PDF processing, previews, indexing, conversion, and document intake workflows. Treat this as high priority where PDF processing is exposed to untrusted files. It is less urgent for isolated systems that do not use MuPDF or do not process external PDFs. Patch validation and asset discovery are the key management actions. Mitigation focus: Identify systems and applications using MuPDF 1.15.0 or affected downstream packages.; Apply vendor security updates from Artifex, Debian, Fedora, or the relevant package maintainer.; Check the referenced MuPDF commits and vendor advisories for fixed package lineage..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.