5.3
Medium
CVE-2026-112036 A vulnerability was detected in Artifex MuPDF up to 1.28.5
Description
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MuPDF 1.28 | 1.28.0 → 1.28.5 | No fix stated |
Other CVEs of MuPDF
The 6 CVEs of MuPDF →
CVE-2026-92413
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9
5.3
Medium
CVE-2026-7233
A vulnerability was determined in Artifex MuPDF
4.8
Medium
CVE-2025-15569
A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows
7.3
High
CVE-2021-3407
A flaw was found in mupdf 1.18.0
7.8
High