0day – MuPDF Stack-based Buffer Overflow in xps_parse_color()
This vulnerability leads to a remote code execution when a user opens a malicious XPS document. When MuPDF loads the XPS document, it loads the first page and parses each element via xps_parse_element() as detailed in the XPS specification. When the crash occurs, the call stack looks like this: mupdf.exe!xps_parse_path, mupdf.exe!xps_parse_element, mupdf.exe!xps_parse_fixed_page, mupdf.exe!xps_run_page, mupdf.exe!fz_run_page_contents, mupdf.exe!pdfapp_loadpage. In this case, the Path element is parsed via the xps_parse_path() function which allows extraction of the attributes and extended attributes (Clip, Data, Fill, ...). If some conditions are fulfilled, we can trigger a stack overflow in the xps_parse_color() function when it parses the value “ContextColor” of the attribute “Fill”.
