CVE-2021-37220: MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consid...

Security readout for executives and security teams

MuPDF through 1.18.1 can write outside intended memory when handling specially crafted input, including input processed by mutool draw. This is a document-processing risk: systems that render or convert untrusted files with MuPDF tooling are the most relevant concern. Exposure is most likely where MuPDF or mutool is installed and used to render, convert, preview, or analyze untrusted documents. The source bundle does not identify specific downstream applications beyond MuPDF/mutool. Treat this as a targeted remediation item for document-processing environments, not an internet-wide emergency based on the provided evidence. Prioritize systems that automatically handle external files or customer-submitted documents. Mitigation focus: Inventory MuPDF and mutool installations and package versions.; Update MuPDF-related packages using vendor or distribution guidance.; For Fedora systems, review and apply the referenced Fedora advisory update..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.