CVE-2026-112036

Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free

State: Published
Severity: 5.3 Medium
Published: Oct 19, 2026
Updated: Oct 19, 2026
Reserved: Oct 18, 2026

Description

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-415 Double Free
CWE-119 Memory Corruption

Affected Products

Product	Versions
MuPDFArtifex	1.28.0Affected 1.28.1Affected 1.28.2Affected 1.28.3Affected 1.28.4Affected 1.28.5Affected

References

VDB-421684 | Artifex MuPDF Signature Locking pdf-xref.c free_char_list double freevdb-entrytechnical-description
VDB-421684 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-112036 | CVE Analysis and Reportthird-party-advisory
Submit #1008495 | MuPDF 1.28.5 Double Freethird-party-advisory
https://bugs.ghostscript.com/show_bug.cgi?id=709768issue-tracking
https://bugs.ghostscript.com/attachment.cgi?id=28609exploit
http://www.ghostscript.com/cgi-bin/findgit.cgi?3984925b660afb8a781ddf504021e91be1bc671ebroken-linkpatch
https://artifex.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.