CVE-2026-25556

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25556
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25556.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25556
Downstream
Related
Published
2026-02-06T16:11:59Z
Modified
2026-08-12T03:51:16Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
MuPDF 1.23.0 through 1.27.0 Barcode Decoding Double Free
Details

MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-415"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25556.json"
}
References

Affected packages

Git / github.com/artifexsoftware/mupdf

Affected ranges

Type
GIT
Repo
https://github.com/artifexsoftware/mupdf
Events
Introduced
56d20b3d29f9fd4e2dabcd9b3abe66bcd1e4990c
Last Affected
d3b7556577b790e9761868c314ad6fd9b6dd86a9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.23.0"
        },
        {
            "last_affected": "1.27.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

1.*
1.23.0
1.24.0
1.24.0-rc1
1.25.0-rc1
1.26.0-rc1
1.26.0-rc2
1.27.0
1.27.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25556.json"