p PatchFirst

CVE-2026-112036

CVE-2026-112036 · Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.

CVSS 5.3 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • mupdf

    Versions
    • 1.28.0: Affected
    • 1.28.1: Affected
    • 1.28.2: Affected
    • 1.28.3: Affected
    • 1.28.4: Affected
    • 1.28.5: Affected

    No fix published

  • mupdf Debian:12

    Versions
    • 1.21.1+ds2-1
    • 1.21.1+ds2-1+deb12u1
    • 1.22.1+ds1-1
    • 1.22.2+ds1-1
    • 1.22.2+ds1-2
    • 1.23.10+ds1-1
    • 1.23.10+ds1-2
    • 1.23.6+ds1-1
    • 1.23.7+ds1-1
    • 1.24.10+ds1-1
    • 1.24.3+ds1-1
    • 1.24.8+ds2-1
    • 1.24.8+ds2-2
    • 1.24.9+ds1-1
    • 1.25.1+ds1-1
    • 1.25.1+ds1-2
    • 1.25.1+ds1-3
    • 1.25.1+ds1-4
    • 1.25.1+ds1-5
    • 1.25.1+ds1-6
    • 1.25.1+ds1-7
    • 1.25.1+ds1-8
    • 1.25.1+ds1-9
    • 1.27.0+ds1-1
    • 1.27.0+ds1-2
    • 1.27.0+ds1-3
    • 1.27.0+ds1-4
    • 1.27.0+ds1-5
    • 1.27.0+ds1-6
    • 1.28.0+ds1-1
    • 1.28.2+ds1-1
    • 1.28.2+ds1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Debian:13

    Versions
    • 1.25.1+ds1-6
    • 1.25.1+ds1-6+deb13u1
    • 1.25.1+ds1-7
    • 1.25.1+ds1-8
    • 1.25.1+ds1-9
    • 1.27.0+ds1-1
    • 1.27.0+ds1-2
    • 1.27.0+ds1-3
    • 1.27.0+ds1-4
    • 1.27.0+ds1-5
    • 1.27.0+ds1-6
    • 1.28.0+ds1-1
    • 1.28.2+ds1-1
    • 1.28.2+ds1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Debian:14

    Versions
    • 1.25.1+ds1-6
    • 1.25.1+ds1-7
    • 1.25.1+ds1-8
    • 1.25.1+ds1-9
    • 1.27.0+ds1-1
    • 1.27.0+ds1-2
    • 1.27.0+ds1-3
    • 1.27.0+ds1-4
    • 1.27.0+ds1-5
    • 1.27.0+ds1-6
    • 1.28.0+ds1-1
    • 1.28.2+ds1-1
    • 1.28.2+ds1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:Pro:16.04:LTS

    Versions
    • 1.7-1
    • 1.7a-1
    • 1.7a-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:Pro:18.04:LTS

    Versions
    • 1.11+ds1-1.1
    • 1.11+ds1-2
    • 1.12.0+ds1-1
    • 1.12.0+ds1-1ubuntu0.1~esm1
    • 1.12.0+ds1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:Pro:20.04:LTS

    Versions
    • 1.15.0+ds1-1
    • 1.16.1+ds1-1ubuntu1
    • 1.16.1+ds1-1ubuntu1+esm1
    • 1.16.1+ds1-1ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:Pro:22.04:LTS

    Versions
    • 1.17.0+ds1-2
    • 1.19.0+ds1-1
    • 1.19.0+ds1-1build1
    • 1.19.0+ds1-2
    • 1.19.0+ds1-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:Pro:24.04:LTS

    Versions
    • 1.22.2+ds1-2
    • 1.22.2+ds1-2build1
    • 1.23.6+ds1-1
    • 1.23.7+ds1-1
    • 1.23.10+ds1-1
    • 1.23.10+ds1-1build1
    • 1.23.10+ds1-1build2
    • 1.23.10+ds1-1build3
    • 1.23.10+ds1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:26.10

    Versions
    • 1.27.0+ds1-3ubuntu2
    • 1.27.0+ds1-3ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mupdf Ubuntu:26.04:LTS

    Versions
    • 1.25.1+ds1-7
    • 1.25.1+ds1-7build1
    • 1.25.1+ds1-7build2
    • 1.27.0+ds1-2ubuntu1
    • 1.27.0+ds1-3ubuntu1
    • 1.27.0+ds1-3ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →