What’s Vulnerable › Vulnerabilities

CVE-2026-40505: MuPDF < 1.27 mutool ANSI Injection via Metadata

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-16 · updated 2026-10-26
• Weakness: CWE-150

Description

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

Affected products

• Artifex MuPDF: before 1.27.0 — fixed in 1.27.0

How to fix

Upgrade to a fixed version: Artifex MuPDF 1.27.0. Check the vendor advisory for mitigations.

References

• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfb
• https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aaca3a4dfb
• https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0
• https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata

Get alerted when CVE-2026-40505 or the next vulnerability affects your stack