DEBIAN-CVE-2026-25556

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-25556

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-25556.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-25556

Upstream

CVE-2026-25556

Published

2026-02-06T17:16:27.387Z

Modified

2026-02-25T11:15:40.890060Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fzfillpixmapfromdisplaylist() when an exception occurs during display list rendering. The function accepts a caller-owned fzpixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fzdecodebarcodefromdisplay_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.

References

https://security-tracker.debian.org/tracker/CVE-2026-25556

Affected packages

Debian:13 / mupdf

Package

Name: mupdf
Purl: pkg:deb/debian/mupdf?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.25.1+ds1-6

1.25.1+ds1-7

1.25.1+ds1-8

1.25.1+ds1-9

1.27.0+ds1-1

1.27.0+ds1-2

1.27.0+ds1-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-25556.json"

Debian:14 / mupdf