CVE-2026-40505

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40505
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40505.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40505
Downstream
Published
2026-04-16T01:20:08.397Z
Modified
2026-07-08T08:13:12.349190692Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
MuPDF < 1.27 mutool ANSI Injection via Metadata
Details

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0f17d789fe8c29b41e47663be82514aaca3a4dfb"
                },
                {
                    "last_affected": "0f17d789fe8c29b41e47663be82514aaca3a4dfb"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40505.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-150"
    ]
}
References

Affected packages

Git / github.com/artifexsoftware/mupdf

Affected ranges

Type
GIT
Repo
https://github.com/artifexsoftware/mupdf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d3b7556577b790e9761868c314ad6fd9b6dd86a9
Fixed
0f17d789fe8c29b41e47663be82514aaca3a4dfb
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.27.0"
        }
    ]
}

Affected versions

0.*
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1.*
1.0
1.0rc1
1.1-forms-tech-preview
1.10
1.10-rc1
1.10-rc2
1.11
1.11-rc1
1.11.1
1.12.0
1.13.0
1.13.0-rc1
1.14.0
1.14.0-rc1
1.15.0
1.15.0-rc1
1.16.0
1.16.0-rc1
1.16.0-rc2
1.16.1
1.16.1-epub-prerelease
1.17.0-rc1
1.18.0
1.18.0-rc1
1.18.1-so-3.12.1-android
1.18.1-so-3.12.1-ios
1.18.1-so-3.12.2b1-android
1.18.1-so-3.12.2b1-ios
1.18.1-so-3.12.4
1.18.1-so-3.12.6
1.19.0-rc1
1.19.0-rc1-so-3.12.7
1.2
1.20.0-rc1
1.21.0-rc1
1.22.0-rc1
1.23.0
1.23.0-rc1
1.24.0
1.24.0-rc1
1.25.0-rc1
1.26.0-rc1
1.26.0-rc2
1.27.0
1.27.0-rc1
1.3rc1
1.4
1.4-ios
1.5
1.5-ios
1.5-ios-appstore
1.5-ios-rc6
1.5-ios-rc7
1.5-ios-rc8
1.6
1.6-appstore
1.6-ios-rc1
1.6-ios-rc2
1.7
1.7-rc1
1.7a
1.8
1.9
1.9-rc1
1.9-rc2
1.9a
Other
android-release-60

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40505.json"