CVE-2017-17866 — pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document

Back Back to CVE browser

HIGH

pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document

Published Dec 23, 2017

7.8

HIGH

CVSS 3.0

EPSS 1.58%

Description

pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles certain length changes when a repair operation occurs during a clean operation, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted PDF document.

Affected products

Remediation

No remediation recorded yet.

Metrics

1.58% 0.01579

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01579

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.58% (0.01579)	74.59th	v5 (v2026.06.15)
Jun 15, 2026	1.58% (0.01579)	72.22th	v5 (v2026.06.15)
Mar 19, 2025	0.29% (0.00288)	49.23th	v4 (v2025.03.14)
Jul 20, 2024	0.63% (0.00634)	79.32th	v3 (v2023.03.01)
May 9, 2024	0.63% (0.00634)	78.99th	v3 (v2023.03.01)
Feb 8, 2024	0.45% (0.00447)	74.26th	v3 (v2023.03.01)
Mar 7, 2023	0.45% (0.00447)	71.03th	v3 (v2023.03.01)
Mar 6, 2023	1.14% (0.01136)	59.45th	v2 (v2022.01.01)
Feb 4, 2022	1.14% (0.01136)	34.23th	v2 (v2022.01.01)
Feb 3, 2022	1.30% (0.01300)	31.12th	v5 (v2026.06.15)
Apr 14, 2021	1.30% (0.01300)	0.00th	v1

Weaknesses (1)

CWE-119

Buffer Overflow

References (3)

http://www.ghostscript.com/cgi-bin/findgit.cgi?520cc26d18c9ee245b56e9e91f9d4fcae02be5f0
x_refsource_CONFIRMPatchThird Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=698699
x_refsource_CONFIRMPermissions RequiredThird Party Advisory
https://www.debian.org/security/2018/dsa-4334
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://www.ghostscript.com/cgi-bin/findgit.cgi?520cc26d18c9ee245b56e9e91f9d4fcae02be5f0		x_refsource_CONFIRMPatchThird Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=698699		x_refsource_CONFIRMPermissions RequiredThird Party Advisory
https://www.debian.org/security/2018/dsa-4334		vendor-advisoryx_refsource_DEBIANThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 23, 2017

Updated Aug 5, 2024

Reserved Dec 23, 2017

Link CVE-2017-17866

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-17866

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-17866