Read the docs
TI-2026-76219 Aliases CVE-2026-112036GHSA-pv37-v42r-g3rq

Double free in Artifex MuPDF Signature Locking code

Priority MEDIUM 63CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Artifex MuPDF up to and including 1.28.5 is affected. A double free in the free_char_list function of the Signature Locking component (CWE-415) lets a remote attacker corrupt memory, though a user must take an action such as opening a crafted document. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ArtifexMuPDF1.28.0; 1.28.1; 1.28.2; 1.28.3; 1.28.4; 1.28.5—No fix listedCNA
  • MuPDF VendorArtifex Affected 1.28.0; 1.28.1; 1.28.2; 1.28.3; 1.28.4; 1.28.5 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*——Artifex
  • cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:* Versions — — ·Artifex

Remediation

The sources list no fixed version for MuPDF. The sources recommend deploying the patch 3984925b660afb8a781ddf504021e91be1bc671e.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-112036
  2. 2026-10-19 Alias added: GHSA-pv37-v42r-g3rq
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: LOW → MEDIUM
  5. 2026-10-21 Affected versions changed · Red Hat
  6. 2026-10-21 CVSS score added · Red Hat

References

Exploit 1

Patch 1

Other 2

  • TI-2017-05861 Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution… KEVCVSS 3.1HIGH 7.8
  • TI-2021-02712 Improper input validation in ghostscript CVSS 3.1CRITICAL 9.9
  • TI-2023-13382 In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential… CVSS 3.1CRITICAL 9.8
  • TI-2021-13164 Memory corruption in mujs CVSS 3.1CRITICAL 9.8
  • TI-2018-11841 An issue was discovered in Artifex Ghostscript before 9.24. CVSS 3.0HIGH 7.8
  • TI-2024-16051 freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable… CVSS 3.1HIGH 7.5
See all 265 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences