CVE-2017-17858

Name: CVE-2017-17858
Creator: NVD / NIST
Published: 2018-01-22T15:29:00.21+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.79%

Last modified Jun 17, 2026

CVE-2017-17858 is a vulnerability of currently unknown severity. Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted.. EPSS estimates a 2.79% chance of exploitation in the next 30 days.

Description

Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted.

Metrics

EPSS Probability

2.79%

84.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-119

Affected Software

Vendor	Product	Versions
Artifex	Mupdf	1.12.0

References

http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=55c3f68d638ac1263a386e0aaa004bb6e8bde731
https://bugs.ghostscript.com/show_bug.cgi?id=698819Permissions Required
https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.mdExploit, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201811-15
http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=55c3f68d638ac1263a386e0aaa004bb6e8bde731
https://bugs.ghostscript.com/show_bug.cgi?id=698819Permissions Required
https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.mdExploit, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201811-15

Timeline

Published: Jan 22, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-17858?

How severe is CVE-2017-17858?

Severity scoring for CVE-2017-17858 is pending analysis. The EPSS model estimates a 2.79% probability of exploitation in the next 30 days.

How do I fix CVE-2017-17858?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-17858?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST