Mupdf EUVD-2026-23147

The vulnerability requires the following specific conditions: the user must execute mutool info (or a similar mutool command that outputs metadata) on an attacker-supplied PDF file containing malicious ANSI escape sequences in metadata fields. The attack depends on user interaction (UI:R in CVSS) - the vulnerability is not exploitable remotely or without the user actively running the tool. Local file system access is required to provide the crafted PDF to the target system. The terminal must interpret ANSI escape sequences (most modern terminals do; some restricted or hardened terminals may not). The user must not have awareness or defensive training regarding spoofed terminal output. No special MuPDF configuration or non-default settings are required; the vulnerability exists in the default behavior of the mutool info command across all versions prior to the patch.

The CVSS 3.3 score reflects low severity with low-risk attack parameters: local access vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R) and limited impact (only integrity; no confidentiality or availability). The attack vector is local, not network, and requires the user to explicitly run mutool info on an attacker-controlled PDF, limiting real-world exposure. EPSS or active exploitation data is not provided, but the presence of a vendor-released patch and public advisory from VulnCheck indicates this is a known, documented issue rather than a zero-day. The primary risk is social engineering via terminal spoofing, not code execution or data exfiltration. Organizations should prioritize higher-severity vulnerabilities; however, this should be patched in routine update cycles, especially for systems where users frequently process untrusted PDFs. The actual risk depends on user behavior: if users are trained to inspect metadata sources or if mutool is run only on trusted files, exploitation likelihood is minimal.

An attacker creates a PDF with a crafted Title metadata field containing ANSI escape codes, such as \033[2J (clear screen) followed by fake text resembling a login prompt. The attacker distributes this PDF via email or file sharing. A user, thinking they are running a legitimate PDF inspection tool, executes mutool info malicious.pdf, which displays the terminal-cleared screen and spoofed prompt. The user then enters their credentials into the fake prompt, which the attacker captures via a background script or social engineering follow-up.