Vulnerability record · CVE-2021-3407 · published 23 February 2021
CVE-2021-3407: MuPDF double free during linearization causes memory corruption
Artifex · Mupdf
MuPDF 1.18.0 contains a double free of an object during the linearization process, which can corrupt memory. The flaw is triggered when processing a crafted document, so it matters to anyone who opens untrusted PDFs with MuPDF-based tools.
Description
A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other potential consequences.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Automated analysis
medium priorityCVSS is medium (5.5) with local access and user interaction required, but the high EPSS percentile and memory-corruption potential justify prompt patching.
What it is
MuPDF 1.18.0 contains a double free of an object during the linearization process, which can corrupt memory. The flaw is triggered when processing a crafted document, so it matters to anyone who opens untrusted PDFs with MuPDF-based tools.
Impact
An attacker can crash the application and potentially achieve memory corruption, though the CVSS vector shows only availability impact. There is no stated confidentiality or integrity impact in the record.
Attack surface
The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges needed (PR:N), meaning the victim must open a malicious file with the affected MuPDF build. No remote or unauthenticated network path is described.
Exploitation
CVE-2021-3407 is not listed in CISA KEV and no ransomware use is documented, but EPSS is high at 0.50234 (98.9th percentile). References are vendor advisories and mailing lists with no public exploit tag.
What to do
- Update MuPDF to a version containing the fix referenced in the Ghostscript git commit cee7cefc610d42fd383b3c80c12cbc675443176a.
- Apply the Debian, Fedora or Gentoo security updates listed in the references for packaged MuPDF builds.
- Avoid opening untrusted PDFs with MuPDF-based viewers until patched, or process them in a sandboxed environment.
- Track the upstream Ghostscript bug 703366 for any further guidance or backports.
Detection
- Monitor for crashes or abnormal termination of MuPDF-based applications when opening PDF files.
- Use memory error detection tooling (for example ASan or Valgrind) on MuPDF builds in test environments to catch double-free behavior.
- Review application logs for repeated failures tied to linearized PDF processing.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-3407 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-3407), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
