CVE-2026-40505

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

CVSS 4.0

4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-26)

CWE

CWE-150

Published

2026-04-16

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• artifex:mupdf

References

• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfb
• https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aaca3a4dfb
• https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0
• https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata

Check your stackJSON