CVE-2026-112036
Medium
Description
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
SeverityMedium
CVSS4.3
Exploit probability—
ProductArtifex Mupdf
PublishedOct 19, 2026
First seenOct 19, 2026
Weakness typeCWE-415CWE-415CWE-119Memory buffer bounds error
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| artifex mupdf | 1.28.0, 1.28.1, 1.28.2, 1.28.3, 1.28.4, 1.28.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.