CVE-2026-40505
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Malicious ANSI escape codes embedded in PDF metadata are passed unsanitized to terminal output when running mutool info.
Risk Assessment
An attacker can manipulate terminal display to conduct social engineering attacks such as fake prompts or spoofed commands. This may lead to operator mistakes and potential execution of unsafe actions.
Recommendation
Update MuPDF to version 1.27 or later. Avoid running mutool info on untrusted PDF files or sanitize output before displaying it in a terminal.
Other vulnerabilities in MuPDF
See all- CVE-2026-58971Unknown
In _mupdf_get_hdr of wprint_mupdf.c, there is an out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2017-6060High
A stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.
- CVE-2017-5991High
An issue was discovered in MuPDF before version 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 related to a NULL pointer dereference in the pdf_run_xobject function during a Fitz fz_paint_pixmap_with_mask painting operation.
- CVE-2016-6525Critical
A heap-based buffer overflow in the pdf_load_mesh_params function in MuPDF can be exploited by remote attackers. Exploiting this vulnerability may lead to denial of service or arbitrary code execution via a large decode array.
- CVE-2025-71382Medium
A vulnerability in MuPDF before version 1.27.0-rc1 allows a DoS attack via a specially crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recursively processes the CSS inheritance chain without a depth limit, exhausting the stack and causing a crash.
- CVE-2026-25556High
A double-free vulnerability in MuPDF versions 1.23.0 through 1.27.0 exists in the fz_fill_pixmap_from_display_list() function during error handling. The function incorrectly drops a caller-owned fz_pixmap pointer in its error path before rethrowing the exception, leading to a double-free that can corrupt the heap and crash the process.
- CVE-2025-46206Medium
An infinite recursion vulnerability was found in Artifex MuPDF versions 1.25.5 and 1.25.6 within the `mutool clean` utility. A remote attacker can cause a denial of service (DoS) by supplying a crafted PDF file with cyclic /Next references in the outline structure.
Original NVD description (English source)
MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS