CVE-2026-112036
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability was detected in Artifex MuPDF in the free_char_list function (source/pdf/pdf-xref.c) within the Signature Locking component. The manipulation results in a double free. The exploit is public and can be initiated remotely; a patch named 3984925b660afb8a781ddf504021e91be1bc671e is available.
Risk Assessment
A remote attacker could trigger a double free, potentially leading to memory corruption and possible code execution. The public availability of the exploit increases the risk.
Recommendation
Deploy patch 3984925b660afb8a781ddf504021e91be1bc671e or update MuPDF to a version containing it. Avoid processing untrusted PDF files until updated.
Other vulnerabilities in Artifex MuPDF
See all- CVE-2017-17866High
Artifex MuPDF before version 1.12.0 mishandles certain length changes during a repair operation in pdf/pdf-write.c, which can lead to buffer overflow and application crash.
- CVE-2017-15587High
An integer overflow was discovered in pdf_read_new_xref_section in Artifex MuPDF 1.11.
- CVE-2017-15369High
The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before September 25, 2017, mishandles a case where a variable may reside in a register. This allows remote attackers to cause a denial of service or possibly other unspecified impacts via a crafted PDF document.
- CVE-2017-14687High
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue arises from mishandling of XML tag name comparisons.
- CVE-2017-14686High
Artifex MuPDF version 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue arises from the lack of checks for negative size fields in a ZIP entry.
- CVE-2017-14685High
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue is related to the xps_load_links_in_glyphs function, which does not verify that an xps font could be loaded.
- CVE-2026-92413Medium
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9 in the function pdf_open_filter of the file pdf-stream.c of the PDF Xref Loading component. Executing a manipulation can lead to a null pointer dereference, and the attack can be launched remotely.
- CVE-2026-7233Low
A vulnerability was found in Artifex MuPDF, specifically an out-of-bounds read in the fz_subset_cff_for_gids function of subset-cff.c, which handles CFF indexes. The attack requires local access, and the exploit has been publicly disclosed. The project was notified but has not responded.
Original NVD description (English source)
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS