CVE-2025-57248

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the application crashes inside libmupdf.dll, specifically in the DataPool::has_data() function.

CVSS v3.1

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.24% chance of exploitation in the next 30 days, 15th percentile

Published

2025-09-15

Proof-of-concept exploits (1)

• sumatrapdfreader/sumatrapdf/issues/5035

References

• CVE Record
• NVD entry

Related

• CVE-2025-5724
• CVE-2025-5725
• CVE-2025-5723
• CVE-2025-5726
• CVE-2025-57227
• CVE-2025-5727