Live › vulnerability › CVE-2026-112036
Go to dashboardMuPDF, a PDF rendering library, has a double free in free_char_list in source/pdf/pdf-xref.c, triggered by manipulating signature-locked content. An attacker who supplies a crafted PDF can corrupt memory, which may crash the process or lead to code execution; the sources say the exploit is public.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any application that opens untrusted PDF files with MuPDF up to 1.28.5, including viewers, converters, and document-processing pipelines that accept uploads. Systems that only process PDFs they generate themselves, or that do not use MuPDF at all, can skip it.
No product ranges from the sources yet.
mutool -v or the library version in your build, and check whether it is 1.28.5 or earliermupdf, libmupdf) to find every service that renders PDFs1.28.5 that includes the upstream patch 3984925b660afb8a781ddf504021e91be1bc671e (the sources do not name the fixed release number)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
This page as .md · .json · in your agent: get_signal("CVE-2026-112036")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.