CVE-2026-25556

MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fzfillpixmapfromdisplaylist() when an exception occurs during display list rendering. The function accepts a caller-owned fzpixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fzdecodebarcodefromdisplay_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.

References

Affected packages

Git / github.com/artifexsoftware/mupdf

Affected ranges

Type

GIT

Repo

https://github.com/artifexsoftware/mupdf

Events

Introduced

56d20b3d29f9fd4e2dabcd9b3abe66bcd1e4990c

Last affected

d3b7556577b790e9761868c314ad6fd9b6dd86a9

Database specific

{
    "versions": [
        {
            "introduced": "1.23.0"
        },
        {
            "last_affected": "1.27.0"
        }
    ]
}

Affected versions

1.*

1.23.0

1.24.0

1.24.0-rc1

1.25.0-rc1

1.26.0-rc1

1.26.0-rc2

1.27.0

1.27.0-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25556.json"