VDB
CVE-2026-25556
CVE-2026-25556
PUBLISHED
CVSS 5.900000095367432 MEDIUM
MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.
EPSS 0.48% · 39.4th percentile
Risk Scores
CVSS 4.0
5.900000095367432
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score
0.48%
39.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| artifex | mupdf | 1.23.0, 1.23.0 |
| Artifex Software | MuPDF | 1.23.0 |
Timeline
- Feb 6, 2026 CVE Published
- Feb 7, 2026 EPSS Score
- Feb 9, 2026 EPSS Score
- Feb 12, 2026 EPSS Score
- Feb 14, 2026 EPSS Score
- Feb 16, 2026 EPSS Score
- Feb 19, 2026 EPSS Score
- Feb 21, 2026 EPSS Score
- Feb 22, 2026 PoC Published
- Feb 23, 2026 EPSS Score
- Feb 23, 2026 PoC Published
- Feb 23, 2026 PoC Published
References
- https://bugs.ghostscript.com/show_bug.cgi?id=709029 issue
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1 patch
- https://mupdf.com/ url
- https://www.vulncheck.com/advisories/mupdf-barcode-decoding-double-free third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25556 advisory
- https://mupdf.com url