CVE-2025-15569

Artifex MuPDF win_main.c get_system_dpi uncontrolled search path

State: Published
Severity: 7.3 High
Published: Feb 10, 2026
Updated: Feb 23, 2026
Reserved: Feb 8, 2026

Description

A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The exploitability is regarded as difficult. Upgrading to version 1.26.2 is sufficient to resolve this issue. Patch name: ebb125334eb007d64e579204af3c264aadf2e244. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	7.3 High	CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X	VulDB
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C	VulDB
3.0	7.0 High	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C	VulDB
2.0	6.0 Medium	AV:L/AC:H/Au:S/C:C/I:C/A:C/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-427 Uncontrolled Search Path
CWE-426 Untrusted Search Path

Affected Products

Product	Versions
MuPDFArtifex	1.26.0Affected 1.26.1Affected 1.26.2Not affected

References

VDB-344924 | Artifex MuPDF win_main.c get_system_dpi uncontrolled search pathvdb-entrytechnical-description
VDB-344924 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #750978 | Artifex Software MuPDF 1.26.2 Uncontrolled Search Paththird-party-advisory
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=ebb125334eb007d64e579204af3c264aadf2e244patch
https://casper.mupdf.com/downloads/archive/mupdf-1.26.2-windows.zippatch
https://artifex.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.