A critical null pointer dereference vulnerability in MuPDF 1.26.4 permits unauthenticated attackers to crash the application by processing malicious EPUB files.

The flaw exists within the break_word_for_overflow_wrap function, where the application fails to validate the node pointer before accessing memory during the rendering of an EPUB document. This allows an unauthenticated attacker to trigger a crash through a specially crafted file.

The primary risk associated with this vulnerability is a denial of service, which can lead to significant operational disruption if MuPDF is integrated into critical document processing pipelines or web-based viewers. While the CVSS score of 7.5 reflects a high severity due to the ease of remote exploitation, the impact is currently limited to service availability rather than data confidentiality or integrity.

Immediate Action: Update MuPDF to the latest version, incorporating the fix found in commit bdd5d241748807378a78a622388e0312332513c5, to resolve the null pointer dereference.

Proactive Monitoring: Monitor system logs for repeated crash events or segmentation faults triggered during the rendering of EPUB or other document types.

Compensating Controls: Implement file type validation and sanitization for any uploaded or processed documents to prevent the ingestion of malformed files that may trigger this vulnerability.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (https://github.com/ISH2YU/CVE-2025-55780).

This vulnerability presents a clear risk to service stability for systems utilizing MuPDF for document rendering. Organizations should immediately verify their MuPDF version and apply the vendor-supplied fix to ensure resilience against potential denial of service attacks. Given the availability of a public proof-of-concept, prompt action is required to minimize the risk of exploitation.