CVE-2025-71382 – MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering

CVE ID :CVE-2025-71382

Published : June 23, 2026, 5:21 p.m. | 22 minutes ago

Description :MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.

Severity: 7.1 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…