Read the docs
TI-2026-20663 Aliases CVE-2026-25556GHSA-39p9-g2pq-q8r7

MuPDF 1.23.0 through 1.27.0 Barcode Decoding Double Free

Priority MEDIUM 60CWE-415Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.

Summary

MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00534 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ArtifexMuPDF1.23.0 – 1.27.0—No fix listedCNA
  • MuPDF VendorArtifex Affected 1.23.0 – 1.27.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*1.23.0 – 1.27.0VulnerableArtifex
  • cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:* Versions 1.23.0 – 1.27.0 Vulnerable ·Artifex

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25556
  2. 2026-10-03 Alias added: GHSA-39p9-g2pq-q8r7
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Other 1

  • TI-2024-16051 freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable… CVSS 3.1HIGH 7.5
  • TI-2023-27942 A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF… CVSS 3.1HIGH 7.5
  • TI-2021-02374 Double free in mupdf CVSS 3.1HIGH 7.8
  • TI-2016-07185 Out-of-bounds write in Artifex MuPDF CVSS 3.1HIGH 7.8
  • TI-2012-04514 SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the… CVSS 3.1HIGH 7.8
  • TI-2023-27939 A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF… CVSS 3.1HIGH 7.5
See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences