This vulnerability exists in the fz_subset_cff_for_gids function of the subset-cff.c file in Artifex MuPDF versions up to 1.28.0. It results in an out-of-bounds read condition when handling CFF Index data. The attack vector is local, requiring the attacker to have local access to the system. The vulnerability was responsibly disclosed to the project, but no patch or official remediation has been provided as of the publication date. The CVSS 4.0 vector indicates low attack complexity and privileges required, with no user interaction necessary.

An attacker with local access can trigger an out-of-bounds read, which may lead to information disclosure or application instability. The vulnerability does not allow remote exploitation or privilege escalation based on the available data. No known active exploitation has been reported.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a patch is released, restricting local access to trusted users and limiting the use of vulnerable MuPDF versions may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.