Buffer overflow in Artifex Mupdf
CVE-2026-112036
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Artifex Mupdf — versions 1.28.0, 1.28.1, 1.28.2
Weakness classification (CWE)
References
- vuldb.com/vuln/421684 (technical-description, vdb-entry)
- vuldb.com/vuln/421684/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-112036 (third-party-advisory)
- vuldb.com/submit/1008495 (third-party-advisory)
- bugs.ghostscript.com/show_bug.cgi (issue-tracking)
- bugs.ghostscript.com/attachment.cgi (exploit)
- www.ghostscript.com/cgi-bin/findgit.cgi (patch, broken-link)
- artifex.com/ (product)
Frequently asked questions
- What is CVE-2026-112036?
- CVE-2026-112036 is a medium-severity vulnerability in Artifex Mupdf, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 4.3/10. Published 2026-10-19.
- How severe is CVE-2026-112036?
- Medium severity. CVSS v3 base score is 4.3 out of 10.