CVE-2025-15569 - CVE House
Back to Database
Status published High CVE-2025-15569

Artifex MuPDF win_main.c get_system_dpi uncontrolled search path

Vulnerability Description

A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. The attack is considered to have high complexity. The exploitability is regarded as difficult. Upgrading to version 1.26.2 is sufficient to resolve this issue. Patch name: ebb125334eb007d64e579204af3c264aadf2e244. Upgrading the affected component is recommended.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15569

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • nmaochea (VulDB User)

References

More from Artifex

View All →
CVE-2025-7462
Artifex GhostPDL New Output File Open Error gdevpdf.c pdf_ferror null pointer dereference
Medium 5.3
CVE-2025-59801
In Artifex GhostXPS before 10.06.0, there is a stack-based buffer...
Medium 4.3
CVE-2025-59800
In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an...
Medium 4.3
CVE-2025-59799
Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in...
Medium 4.3
CVE-2025-59798
Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in...
Medium 4.3

Affected Vendor

Affected Software

MuPDF
Vulnerable Versions:
1.26.0, 1.26.1, 1.26.2

Timeline

Official Publish: February 10th, 2026
Last Modified: February 23rd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C

Weaknesses (CWE)

CWE-427 CWE-426

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow
Persistence
T1574.001 DLL Search Order Hijacking
Privilege Escalation
T1547 Boot or Logon Autostart Execution
Persistence
T1036 Masquerading
Defense Evasion
T1059 Command and Scripting Interpreter
Execution
T1543 Create or Modify System Process
Persistence
T1569 System Services
Execution