DEBIAN-CVE-2026-112036
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-112036
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112036.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-112036
- Upstream
- CVE-2026-112036
- Published
- 2026-10-19T12:47:27Z
- Modified
- 2026-10-19T13:00:06Z
- Summary
- [none]
- Details
-
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
- References
Affected packages
Debian:12 / mupdf
Package
- Name
- mupdf
- Purl
- pkg:deb/debian/mupdf?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.21.1+ds2-1
1.21.1+ds2-1+deb12u1
1.22.1+ds1-1
1.22.2+ds1-1
1.22.2+ds1-2
1.23.6+ds1-1
1.23.7+ds1-1
1.23.10+ds1-1
1.23.10+ds1-2
1.24.3+ds1-1
1.24.8+ds2-1
1.24.8+ds2-2
1.24.9+ds1-1
1.24.10+ds1-1
1.25.1+ds1-1
1.25.1+ds1-2
1.25.1+ds1-3
1.25.1+ds1-4
1.25.1+ds1-5
1.25.1+ds1-6
1.25.1+ds1-7
1.25.1+ds1-8
1.25.1+ds1-9
1.27.0+ds1-1
1.27.0+ds1-2
1.27.0+ds1-3
1.27.0+ds1-4
1.27.0+ds1-5
1.27.0+ds1-6
1.28.0+ds1-1
1.28.2+ds1-1
1.28.2+ds1-2
Debian:13 / mupdf
Package
- Name
- mupdf
- Purl
- pkg:deb/debian/mupdf?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / mupdf
Package
- Name
- mupdf
- Purl
- pkg:deb/debian/mupdf?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected