Artifex MuPDF CVE-2026-112036

Exploitation requires a victim to open an attacker-crafted PDF that exercises the Signature Locking code path reaching free_char_list in source/pdf/pdf-xref.c; the UI:P metric means the flaw does not fire without this user-initiated file-open action. No authentication is required (PR:N), and no special non-default configuration is indicated in the description - any MuPDF deployment (standalone mutool or an application embedding the library) up to and including version 1.28.5 that parses untrusted PDFs is exposed. The limiting factors are the mandatory user interaction and the availability-only impact: successful exploitation crashes the parsing process (DoS) but does not, per the CVSS metrics, yield code execution, data disclosure, or integrity loss.

This is a moderate, availability-only issue rather than a top priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L, score 5.3) indicates a network-reachable, low-complexity, unauthenticated flaw, but one that requires passive user interaction (UI:P - a victim must open a malicious PDF) and whose only impact is low availability (VA:L) - consistent with a double free (CWE-415) causing a crash/DoS rather than code execution or data exposure. Exploit maturity is E:P (Proof of Concept), matching the input signal that publicly available exploit code exists; there is NO CISA KEV listing, so this is not confirmed active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The provided 'Information Disclosure' tag CONFLICTS with the CVSS impact metrics (VC:N - no confidentiality impact) and with the CWE-415 double-free nature, which typically yields a crash, not disclosure; treat the tag as likely mislabeled and the real impact as denial of service. Net: a legitimately patchable bug with a public POC, but low blast radius (no confidentiality/integrity impact, user interaction required), so it ranks below RCE-class or KEV-listed vulnerabilities.

An attacker crafts a malicious PDF containing a signature-locking structure that triggers the double free in free_char_list when parsed by MuPDF. The victim opens the file in a MuPDF-based viewer or tool (e.g. via mutool or an embedding application), causing a double free that crashes or destabilizes the process. A proof-of-concept exploit/attachment is publicly available via the Ghostscript bug tracker, so the trigger path is already documented.