CVE-2026-112036
Received Received - Intake

Double Free Vulnerability in Artifex MuPDF

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112036
EUVD
EUVD-2026-104029

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Artifex MuPDF 1.28.0
Artifex MuPDF 1.28.1
Artifex MuPDF 1.28.2
Artifex MuPDF 1.28.3
Artifex MuPDF 1.28.4
Artifex MuPDF 1.28.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a double free issue in Artifex MuPDF up to version 1.28.5. It occurs in the free_char_list function of the source/pdf/pdf-xref.c file, specifically in the Signature Locking component. A double free happens when memory is freed twice, which can lead to crashes or arbitrary code execution. The exploit is publicly available, increasing the risk of attacks.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. It only mentions the affected component and recommends applying a patch.

Impact Analysis

If you use Artifex MuPDF versions up to 1.28.5, this vulnerability could allow remote attackers to cause denial of service or execute arbitrary code by exploiting the double free flaw. The public availability of the exploit raises the risk of real-world attacks targeting vulnerable systems.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves a double free issue in Artifex MuPDF, which could lead to denial of service or potential code execution. However, without explicit details on data exposure or processing impacts, its compliance implications remain unclear.

Mitigation Strategies

Update Artifex MuPDF to version 1.28.5 or apply the patch named 3984925b660afb8a781ddf504021e91be1bc671e to address the double free vulnerability in the Signature Locking component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart