The MuPDF update fixes two notable security vulnerabilities: CVE-2025-55780, which is a null pointer dereference occurring in break_word_for_overflow_wrap(), and CVE-2026-25556, a double-free vulnerability in fz_fill_pixmap_from_display_list(). These issues could lead to crashes or memory corruption. The update also transitions MuPDF from a static-only build to a shared library model to resolve symbol loading issues and includes multiple functional and performance improvements across several minor versions (1.25.4 to 1.27.2). The vendor advisory does not specify exact affected versions or provide explicit patch links but indicates these issues are addressed in the update.

The null pointer dereference and double-free vulnerabilities can cause application crashes or memory corruption, potentially leading to denial of service or other stability issues in applications using MuPDF. The update mitigates these risks by fixing the underlying code defects. No information about exploitation in the wild is provided.

A security update for MuPDF has been released that addresses these vulnerabilities. Users should apply the update provided by their vendor or distribution to remediate these issues. Since the vendor advisory indicates these fixes are included in the update, no additional mitigation steps are required beyond applying the update. Patch status is not explicitly confirmed; users should consult the vendor advisory for current remediation guidance.