CVE-2025-71382

The record

MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.

Affected packages

Related vulnerabilities

• CVE-2026-92822 A flaw was found in libmodulemd. CWE-674
• CVE-2026-112895 Pillow is a Python imaging library. CWE-674
• CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. CWE-674
• CVE-2026-109267 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL… CWE-674
• CVE-2026-109264 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in… CWE-674
• CVE-2026-107678 FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in… CWE-674
• CVE-2026-107208 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-674
• CVE-2026-106572 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-674