{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for mupdf",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for mupdf fixes the following issues:\n\nChanges in mupdf:\n\n- Build and ship MuPDF as a shared library (make shared=yes) instead of\n  static-only:\n  * New subpackage libmupdf27_2 carries libmupdf.so.27.2 (the SONAME\n    tracks the upstream minor.patch version).\n  * Replaced the static-only mupdf-devel-static with mupdf-devel, which\n    ships the .so symlink and a generated mupdf.pc (upstream provides no\n    pkg-config file).\n  * mupdf-devel obsoletes the dropped mupdf-devel-static so it is\n    cleanly replaced on upgrade (resolves the /usr/include/mupdf\n    header file conflict flagged in staging).\n- Consumers that statically embedded libmupdf.a (e.g. zathura\u0027s\n  pdf-mupdf plugin) failed to load with \"undefined symbol:\n  jpeg_resync_to_restart\" because openSUSE builds MuPDF against system\n  codec libraries and the static archive does not pull them in; linking\n  against the shared library (which carries those codecs in its own\n  NEEDED) fixes this (boo#1165273).\n\n- update to 1.27.2:\n  * Add ImageMask operation in image rewriter.\n  * SText vector merging, and \u0027fuzzy-vectors\u0027 option.\n  * SText corruption fixes.\n  * SText Depth First Search iterator fixes.\n\n- Update to 1.27.1:\n  * Several optimizations, tweaks, and fixes to the structured text\n    device text extraction.\n  * Improve table-hunting code in structured text device.\n  * Import image-rafting code from layout project to the structured\n    text device.\n  * Fix bug causing FitR link destination rectangles to remain\n    untransformed.\n  * Fix bug causing xps rendering to enter eternal loop.\n- CVE-2025-55780: null pointer dereference occurs in the function\n  break_word_for_overflow_wrap() (bsc#1250443)\n- CVE-2026-25556: double-free in fz_fill_pixmap_from_display_list()\n  (bsc#1257944)\n\n- Update to version 1.26.3:\n  * Cope with /AS being an indirection in annotations.\n  * PDF redaction should honour RO entries.\n  * Recompress lossy (JPEG, J2K, JXR, etc) as JPEG when writing to\n    SVG.\n  * Improve speed of roll in postscript functions.\n  * Be more accepting of EmbeddedFiles FileSpecs.\n  * Extend rectangles to improve strikeout detection.\n  * Fix strikeout detection failure caused by FP inaccuracy.\n  * Make mutool trace and mutool draw -Ftrace output identical.\n  * Re-order mutool sub-commands, highlight the most useful\n    commands at the top.\n  * Use fz_strstrcase for case insensitive file dialog filters in\n    mupdf-gl.\n- Use system brotli, tesseract for builds\n- More specific directory globs for files section.\n\n- Update to 1.25.6:\n  * Avoid crash when noto fonts have zero size.\n  * Fix bug in q/Q count balancing.\n  * Improve clip/layer nesting to handle more than 1000 nested levels.\n  * Fix bug where all redaction annotations were applied intead of just one.\n\n- Update to 1.25.5:\n  * Allow pdf_lookup_page_number_slow on deleted pages.\n  * Fix issue in Fax decoder.\n  * Tweak antidropout code in the non-AA rasterizer.\n  * Fix bug ignoring last entry in UAX 14 line-breaking table.\n  * Let Windows handle unhandled ALT-key combinations.\n  * Cope with \"undersized\" cross-reference streams.\n  * Use ULL rather than Ui64 in windows specific time funcs\n  * Fix redaction problem with form transforms.\n  * Fix Makefiles to test/alter CFLAGS, not XCFLAGS.\n  * Avoid double drop of fz_html_tree upon exception in xml_to_boxes().\n  * Free unopened pages instead of waiting for document to reap them.\n  * Do not create bad write options if encrypt option was set to unknown value.\n  * PDF saving: Perform a pre-pass to load objects before saving.\n  * Change capitalization in mutool usage to be consistent.\n  * Ensure that cfb archive entry names are null-terminated.\n  * Allocate xml root node in pool.\n  * Fix typo in LZW compressed inline image dictionary.\n  * Report error in audit tool, otherwise it counts as unhandled.\n  * Handle PDF objects numbered outside xref range.\n  * Check whether opts is NULL when cleaning a PDF file.\n  * Check whether the argument list is NULL, when argument are said to exist.\n  * Consistently use uint32_t for color in stext device.\n  * Sync open page numbers after undo has swapped the xrefs, not before.\n  * Clear the in-doc flag when removing a page from the opened page list.\n  * Add support archive script to create commercial tarballs.\n\n- Update to 1.25.4:\n  * Add common Noto font name lookup function.\n  * Improve font Ascent/Descent handling.\n  * Allow fz_store_size to be customised in Java.\n  * Add fz_atoz() convenience function to parse size_t.\n  * Add and use convenience function for loading user CSS.\n  * Fix valgrind error seen with saving pdfs with garbage collection.\n  * Process both widgets and annotations when rewriting images.\n  * Adjust vector handling in page segmentation.\n  * Only include latest object versions when gathering object streams.\n  * Add AFRelationship property.\n  * Minimise size of softmasks before rendering.\n  * Fix bug where mutool clean produced object 0 with invalid gen num.\n  * Fix bbox calculation in segmentation.\n  * Improve exception messages from tesseract.\n  * When deleting widget fields, compare the objects, not their pointers.\n  * Fix for JBIG2 data not having the correct filter attached.\n  * Fix concerning renumbered PDF encryption dictionaries.\n\n- Update to 1.25.3:\n  * Fix bug where structure trees were always kept.\n  * Add option to drop/keep structure trees when rearranging or subsetting pages.\n\n- Update to 1.25.2:\n  * Add support to spot invisible text in structured text.\n  * Fix sanitisation of clipping paths.\n  * Fix leak in C++ wrappers.\n\n- Update to 1.25.1:\n  * Fix bug in structured text to html conversion concerning color.\n\n- For changes in 1.25.0 and older see https://mupdf.com/releases/history\n\n- Update to 1.24.10:\n  * Several fixes to python scripts for bindings.\n  * Fix bug relating to redactions on pages with shared content\n    streams.\n  * Fix bug when both color keying and softmasking is used.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-375",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21180-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1165273",
        "url": "https://bugzilla.suse.com/1165273"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1250443",
        "url": "https://bugzilla.suse.com/1250443"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257944",
        "url": "https://bugzilla.suse.com/1257944"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55780 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55780/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25556 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25556/"
      }
    ],
    "title": "Security update for mupdf",
    "tracking": {
      "current_release_date": "2026-06-30T11:34:14Z",
      "generator": {
        "date": "2026-06-30T11:34:14Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21180-1",
      "initial_release_date": "2026-06-30T11:34:14Z",
      "revision_history": [
        {
          "date": "2026-06-30T11:34:14Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libmupdf27_2-1.27.2-bp160.1.1.aarch64",
                "product": {
                  "name": "libmupdf27_2-1.27.2-bp160.1.1.aarch64",
                  "product_id": "libmupdf27_2-1.27.2-bp160.1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "mupdf-1.27.2-bp160.1.1.aarch64",
                "product": {
                  "name": "mupdf-1.27.2-bp160.1.1.aarch64",
                  "product_id": "mupdf-1.27.2-bp160.1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "mupdf-devel-1.27.2-bp160.1.1.aarch64",
                "product": {
                  "name": "mupdf-devel-1.27.2-bp160.1.1.aarch64",
                  "product_id": "mupdf-devel-1.27.2-bp160.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libmupdf27_2-1.27.2-bp160.1.1.ppc64le",
                "product": {
                  "name": "libmupdf27_2-1.27.2-bp160.1.1.ppc64le",
                  "product_id": "libmupdf27_2-1.27.2-bp160.1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "mupdf-1.27.2-bp160.1.1.ppc64le",
                "product": {
                  "name": "mupdf-1.27.2-bp160.1.1.ppc64le",
                  "product_id": "mupdf-1.27.2-bp160.1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "mupdf-devel-1.27.2-bp160.1.1.ppc64le",
                "product": {
                  "name": "mupdf-devel-1.27.2-bp160.1.1.ppc64le",
                  "product_id": "mupdf-devel-1.27.2-bp160.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libmupdf27_2-1.27.2-bp160.1.1.s390x",
                "product": {
                  "name": "libmupdf27_2-1.27.2-bp160.1.1.s390x",
                  "product_id": "libmupdf27_2-1.27.2-bp160.1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "mupdf-1.27.2-bp160.1.1.s390x",
                "product": {
                  "name": "mupdf-1.27.2-bp160.1.1.s390x",
                  "product_id": "mupdf-1.27.2-bp160.1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "mupdf-devel-1.27.2-bp160.1.1.s390x",
                "product": {
                  "name": "mupdf-devel-1.27.2-bp160.1.1.s390x",
                  "product_id": "mupdf-devel-1.27.2-bp160.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libmupdf27_2-1.27.2-bp160.1.1.x86_64",
                "product": {
                  "name": "libmupdf27_2-1.27.2-bp160.1.1.x86_64",
                  "product_id": "libmupdf27_2-1.27.2-bp160.1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "mupdf-1.27.2-bp160.1.1.x86_64",
                "product": {
                  "name": "mupdf-1.27.2-bp160.1.1.x86_64",
                  "product_id": "mupdf-1.27.2-bp160.1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "mupdf-devel-1.27.2-bp160.1.1.x86_64",
                "product": {
                  "name": "mupdf-devel-1.27.2-bp160.1.1.x86_64",
                  "product_id": "mupdf-devel-1.27.2-bp160.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libmupdf27_2-1.27.2-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.aarch64"
        },
        "product_reference": "libmupdf27_2-1.27.2-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libmupdf27_2-1.27.2-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.ppc64le"
        },
        "product_reference": "libmupdf27_2-1.27.2-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libmupdf27_2-1.27.2-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.s390x"
        },
        "product_reference": "libmupdf27_2-1.27.2-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libmupdf27_2-1.27.2-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.x86_64"
        },
        "product_reference": "libmupdf27_2-1.27.2-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mupdf-1.27.2-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.aarch64"
        },
        "product_reference": "mupdf-1.27.2-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mupdf-1.27.2-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.ppc64le"
        },
        "product_reference": "mupdf-1.27.2-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mupdf-1.27.2-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.s390x"
        },
        "product_reference": "mupdf-1.27.2-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mupdf-1.27.2-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.x86_64"
        },
        "product_reference": "mupdf-1.27.2-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mupdf-devel-1.27.2-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.aarch64"
        },
        "product_reference": "mupdf-devel-1.27.2-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mupdf-devel-1.27.2-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.ppc64le"
        },
        "product_reference": "mupdf-devel-1.27.2-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mupdf-devel-1.27.2-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.s390x"
        },
        "product_reference": "mupdf-devel-1.27.2-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mupdf-devel-1.27.2-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.x86_64"
        },
        "product_reference": "mupdf-devel-1.27.2-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-55780",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55780"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node-\u003enext is valid before accessing node-\u003enext-\u003eoverflow_wrap, resulting in a crash if the split fails or returns a partial node chain.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.s390x",
          "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.s390x",
          "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55780",
          "url": "https://www.suse.com/security/cve/CVE-2025-55780"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250443 for CVE-2025-55780",
          "url": "https://bugzilla.suse.com/1250443"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.s390x",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.s390x",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-30T11:34:14Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-55780"
    },
    {
      "cve": "CVE-2026-25556",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25556"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.s390x",
          "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.s390x",
          "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.s390x",
          "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25556",
          "url": "https://www.suse.com/security/cve/CVE-2026-25556"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257944 for CVE-2026-25556",
          "url": "https://bugzilla.suse.com/1257944"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.s390x",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.s390x",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.s390x",
            "openSUSE Leap 16.0:libmupdf27_2-1.27.2-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.s390x",
            "openSUSE Leap 16.0:mupdf-1.27.2-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.s390x",
            "openSUSE Leap 16.0:mupdf-devel-1.27.2-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-30T11:34:14Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25556"
    }
  ]
}