VU#951662: MuPDF by Artifex contains integer overflow vulnerability.
2026-04-02T20:52:10Z•69507f37eeab533bcb6e9b818da0b97ec32ba790180febb785187045ec3730c7
CVE-2026-1995CVE-2026-2275CVE-2026-2286CVE-2026-3308Code InterpreterCrewAIHarborIDriveKubernetesKyvernoLibreChatNode.jsSSRFdefault passwordgraphql-upload-minimalhard-coded credentialsheap corruptionheap out-of-boundsinteger overflowlocal privilege escalationlog injectionnamespaced-policyprototype pollutionremote code executionunsafe deserialization
What happened
The document catalogs multiple distinct vulnerabilities across open-source and commercial software: an integer overflow in Artifex MuPDF leading to heap out‑of‑bounds writes and potential code execution (CVE-2026-3308); SSRF in Kyverno allowing namespace-scoped policies to pivot to internal services; multiple CrewAI flaws including a Code Interpreter RCE (CVE-2026-2275) and related SSRF (CVE-2026-2286); a Windows local privilege escalation in IDrive allowing arbitrary execution as SYSTEM (CVE-2026-1995); hard-coded/default admin credentials in GoHarbor/Harbor; log‑injection in LibreChat RAG; a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 69507f37eeab533bcb6e9b818da0b97ec32ba790180febb785187045ec3730c7
- Enrichment time
- 2026-04-02T20:52:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.