CVE-2026-112036CWE-119CWE-415

CVE-2026-112036

Medium · published October 19, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00337 · 26.0th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-415 · Double Free
Published
2026-10-19T05:16Z
References (8)
http://www.ghostscript.com/cgi-bin/findgit.cgi?3984925b660afb8a781ddf504021e91be1bc671e · [email protected]https://artifex.com/ · [email protected]https://bugs.ghostscript.com/attachment.cgi?id=28609 · [email protected]https://bugs.ghostscript.com/show_bug.cgi?id=709768 · [email protected]https://vuldb.com/cve/CVE-2026-112036 · [email protected]https://vuldb.com/submit/1008495 · [email protected]https://vuldb.com/vuln/421684 · [email protected]https://vuldb.com/vuln/421684/cti · [email protected]
EPSS history
Timeline
  • 20 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 19 OCT 00:45Z
    Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
    cvelistv5
  • 19 OCT 00:45Z
    Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
    cvelistv5