{"id":"CVE-2026-112036","kind":"vulnerability","aliases":["CVE-2026-112036"],"related":[],"title":"MuPDF: double free in signature locking lets a crafted PDF crash or run code","description":"A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.","summary":"MuPDF, a PDF rendering library, has a double free in free_char_list in source/pdf/pdf-xref.c, triggered by manipulating signature-locked content. An attacker who supplies a crafted PDF can corrupt memory, which may crash the process or lead to code execution; the sources say the exploit is public.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mupdf","package","pdf-processing","self-hosted"],"not_affected_if":["no-mupdf-use","trusted-pdfs-only"],"how_to_check":"- Find the MuPDF version in use with `mutool -v` or the library version in your build, and check whether it is `1.28.5` or earlier\n- Search dependencies for the MuPDF library (`mupdf`, `libmupdf`) to find every service that renders PDFs","fix":"- Upgrade MuPDF to a release after `1.28.5` that includes the upstream patch 3984925b660afb8a781ddf504021e91be1bc671e (the sources do not name the fixed release number)\n- Rebuild and redeploy any service or tool that statically links MuPDF","status":"open","published_at":"2026-10-19T01:16:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:30:52+00:00","updated_at":"2026-10-25T04:30:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:30:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MuPDF to a release after `1.28.5` that includes the upstream patch 3984925b660afb8a781ddf504021e91be1bc671e (the sources do not name the fixed release number)\n- Rebuild and redeploy any service or tool that statically links MuPDF","reach":"internet","title":"MuPDF: double free in signature locking lets a crafted PDF crash or run code","impact":"high","summary":"MuPDF, a PDF rendering library, has a double free in free_char_list in source/pdf/pdf-xref.c, triggered by manipulating signature-locked content. An attacker who supplies a crafted PDF can corrupt memory, which may crash the process or lead to code execution; the sources say the exploit is public.","category":"package","nicknames":[],"who_cares":["mupdf","pdf-processing","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Crafted PDF corrupts memory, possibly running attacker code","analyst_note":"Confirm the fixed release version and whether the double free is reachable with default settings; check the upstream commit 3984925b660afb8a781ddf504021e91be1bc671e and the NVD entry.","how_to_check":"- Find the MuPDF version in use with `mutool -v` or the library version in your build, and check whether it is `1.28.5` or earlier\n- Search dependencies for the MuPDF library (`mupdf`, `libmupdf`) to find every service that renders PDFs","needs_analyst":true,"not_affected_if":["no-mupdf-use","trusted-pdfs-only"],"who_is_affected":"Any application that opens untrusted PDF files with MuPDF up to 1.28.5, including viewers, converters, and document-processing pipelines that accept uploads. Systems that only process PDFs they generate themselves, or that do not use MuPDF at all, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":3360,"output_tokens":690,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112036':17A,20A '-2026':16A,19A '1.28.5':87C '3984925b660afb8a781ddf504021e91be1bc671e':130C 'artifex':83C 'attack':52B,112C 'char':40B,93C 'code':14A,69B 'compon':101C 'content':50B 'corrupt':59B 'craft':9A,56B 'crash':11A,63B 'cve':15A,18A 'deploy':139C 'detect':81C 'doubl':2A,36B,109C 'execut':70B 'exploit':75B,118C 'file':97C 'fix':132C 'free':3A,37B,39B,92C,110C 'function':91C 'host':28B 'impact':89C 'initi':115C 'issu':134C 'lead':67B 'let':7A 'librari':33B 'list':41B,94C 'lock':6A,49B,103C 'manipul':46B,106C 'may':62B,113C,123C 'memori':60B 'mupdf':1A,21B,29B,84C 'name':129C 'packag':22B 'patch':127C,141C 'pdf':10A,24B,31B,57B 'pdf-process':23B 'perform':104C 'process':25B,65B 'public':77B,121C 'recommend':137C 'remot':116C 'render':32B 'result':107C 'run':13A 'say':73B 'self':27B 'self-host':26B 'signatur':5A,48B,102C 'signature-lock':47B 'sourc':72B 'source/pdf/pdf-xref.c':43B,98C 'suppli':54B 'trigger':44B 'use':125C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Any application that opens untrusted PDF files with MuPDF up to 1.28.5, including viewers, converters, and document-processing pipelines that accept uploads. Systems that only process PDFs they generate themselves, or that do not use MuPDF at all, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T01:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112036","severity":null,"published_at":"2026-10-19T01:16:37+00:00","modified_at":"2026-10-19T17:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}