Security readout for executives and security teams
Plain-English summary
A malicious EPUB can crash software that uses MuPDF to render EPUB content. The issue is stack exhaustion from uncontrolled recursion during CSS inheritance handling. It requires a user or workflow to process the file, but no authentication. The main business impact is denial of service, not data theft or code execution based on the provided sources.
Executive priority
Prioritize remediation for internet-facing upload, preview, conversion, or email-processing services because a single file can crash an affected process. Treat desktop-only exposure as lower urgency but still patch during the next maintenance cycle.
Technical view
MuPDF before 1.27.0-rc1 has CWE-674 uncontrolled recursion in value_from_inheritable_property() in css-apply.c. Deeply nested HTML elements with inline CSS can force recursive CSS inheritance evaluation until the process stack is exhausted, crashing applications that use MuPDF for EPUB rendering.
Likely exposure
Exposure is most likely in document viewers, converters, preview services, or ingestion pipelines that embed MuPDF and accept EPUB files from users, partners, email, uploads, or web content. Systems that do not render EPUB through MuPDF are not indicated as affected by the bundle.
Exploitation context
The bundle describes attacker-supplied malicious EPUB files and user interaction. KEV is false, and no provided source states active exploitation in the wild. A referenced bug is tagged as exploit, but this assessment does not include reproduction details or weaponization guidance.
Researcher notes
Evidence supports denial of service through stack exhaustion only. The provided CVSS v4 vector is AV:N/AC:L/PR:N/UI:P with high availability impact and no confidentiality or integrity impact. Affected-version metadata is sparse, so rely on the description and upstream fix boundary.
Mitigation direction
- Upgrade MuPDF to 1.27.0-rc1 or a later vendor-supported fixed build.
- Apply the referenced upstream patch if maintaining a backported MuPDF build.
- Restrict or sandbox untrusted EPUB rendering until patched.
- Disable EPUB preview or conversion for untrusted sources where business impact is acceptable.
- Check Artifex guidance for any newer stable release or vendor-specific advisories.
Validation and detection
- Inventory applications and services that embed MuPDF or link against it.
- Confirm deployed MuPDF versions are not earlier than 1.27.0-rc1.
- Identify whether EPUB rendering is enabled in user-facing or automated workflows.
- Verify downstream packages include the upstream fix or an equivalent backport.
- Run safe regression tests confirming EPUB rendering no longer crashes under nested-content cases.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-674: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-71382 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H2.83.6VulnCheckVulnerability scoring details
Base CVSS 4.0 score
7.1HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0-rc1CVE reference, VulnCheck · release-notes
- https://bugs.ghostscript.com/show_bug.cgi?id=708840CVE reference, VulnCheck · technical-description, exploit
- https://github.com/ArtifexSoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94eCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/mupdf-rc1-stack-exhaustion-dos-via-epub-css-renderingCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Recursion
Uncontrolled Recursion represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.