CVE-2026-112036: artifex mupdf
CVSS: 5.3v4.0MediumReceived
Published 19-10-2026Last modified 19-10-2026
Vulnerability summary
CVE-2026-112036 is a medium (CVSS 5.3) vulnerability in artifex mupdf. 1 public exploit is recorded.
CVSS score
5.3/10
010
Medium · v4.0 (CVE.org)EPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 19-10-2026PublishedVulnerability first disclosed.
Description
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
CVSS metrics
7 scores · 2 sources · 4 versionsMedium 5.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PSources2 sources · 2.1–5.3
- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
Medium 4.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:CSourcesAll 2 agree
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Medium 4.3Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:CSourcesSingle source
Medium 5.0Preferred score · CVE.org (CNA)
AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:CSourcesAll 2 agree
- NVDNIST5.0MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugs.ghostscript.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
- CWE-415Double FreeThe product calls free() twice on the same memory address.
Affected systems
Artifex1 product
- mupdf1.28.0 | 1.28.1 | 1.28.2 | 1.28.3 | 1.28.4 | 1.28.5
1 vendor · 1 product
References
8 links- vuldb.com/cve/CVE-2026-112036Third Party Advisory
- vuldb.com/submit/1008495Third Party Advisory
- bugs.ghostscript.com/show_bug.cgi?id=709768Issue Tracking
- artifex.comProduct