CVE-2018-18662

There is an out-of-bounds read in fz_run_t3_glyph in fitz/font.c in Artifex MuPDF 1.14.0, as demonstrated by mutool.

• CWE-125

• http://www.securityfocus.com/bid/105755Third Party Advisory, VDB Entry
• https://bugs.ghostscript.com/show_bug.cgi?id=700043Exploit, Third Party Advisory
• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=164ddc22ee0d5b63a81d5148f44c37dd132a9356
• https://github.com/TeamSeri0us/pocs/tree/master/mupdfExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00019.html
• http://www.securityfocus.com/bid/105755Third Party Advisory, VDB Entry
• https://bugs.ghostscript.com/show_bug.cgi?id=700043Exploit, Third Party Advisory
• https://github.com/TeamSeri0us/pocs/tree/master/mupdfExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00019.html

Published

Oct 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18656The PureVPN client before 6.1.0 for Windows stores Login Cre…
• CVE-2018-18657An issue was discovered in Arcserve Unified Data Protection …
• CVE-2018-18658An issue was discovered in Arcserve Unified Data Protection …
• CVE-2018-18659An issue was discovered in Arcserve Unified Data Protection …
• CVE-2018-18660An issue was discovered in Arcserve Unified Data Protection …6.1
• CVE-2018-18661An issue was discovered in LibTIFF 4.0.9. There is a NULL po…
• CVE-2018-18665The mintToken function of Nexxus (NXX) aka NexxusToken, an E…
• CVE-2018-18666The mintToken function of SwftCoin (SWFTC) aka SwftCoin, an …
• CVE-2018-18667The mintToken function of Pylon (PYLNT) aka PylonToken, an E…
• CVE-2018-18668GNUBOARD5 before 5.3.2.0 has XSS that allows remote attacker…
• CVE-2018-18669GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to in…
• CVE-2018-18670GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to in…