CVE-2026-112036

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.

CVSS 4.0

2.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS

0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-25)

CWEs

CWE-119, CWE-415

Published

2026-10-19

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

References

• http://www.ghostscript.com/cgi-bin/findgit.cgi?3984925b660afb8a781ddf504021e91be1bc671e
• https://artifex.com/
• https://bugs.ghostscript.com/attachment.cgi?id=28609
• https://bugs.ghostscript.com/show_bug.cgi?id=709768
• https://vuldb.com/cve/CVE-2026-112036

Check your stackJSON