CVE-2026-25556: CWE-415 Double Free in Artifex Software MuPDF
MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.
AI Analysis
Technical Summary
CVE-2026-25556 is a double-free vulnerability in Artifex Software's MuPDF library, specifically in versions 1.23.0 through 1.27.0. The issue arises in the fz_fill_pixmap_from_display_list() function, which accepts a caller-owned fz_pixmap pointer. If an exception occurs during display list rendering, the function erroneously frees the pixmap in its error handling path before rethrowing the exception. Since the caller also frees the same pixmap during cleanup, this results in a double-free condition. This vulnerability affects the barcode decoding path (fz_decode_barcode_from_display_list) and can be triggered by crafted inputs that cause rendering-time errors, potentially leading to heap corruption and application crashes.
Potential Impact
Successful exploitation of this vulnerability can cause heap corruption and crash the affected process. This impacts the stability and reliability of applications using the vulnerable MuPDF versions with barcode decoding enabled. There is no indication from the data that this leads to code execution or privilege escalation.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and consider disabling barcode decoding functionality in MuPDF if feasible to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-25556: CWE-415 Double Free in Artifex Software MuPDF
Description
MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.
CVSS v4.0
Score 5.9medium
Affected software
pkg:github/artifexsoftware/mupdfRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-25556 is a double-free vulnerability in Artifex Software's MuPDF library, specifically in versions 1.23.0 through 1.27.0. The issue arises in the fz_fill_pixmap_from_display_list() function, which accepts a caller-owned fz_pixmap pointer. If an exception occurs during display list rendering, the function erroneously frees the pixmap in its error handling path before rethrowing the exception. Since the caller also frees the same pixmap during cleanup, this results in a double-free condition. This vulnerability affects the barcode decoding path (fz_decode_barcode_from_display_list) and can be triggered by crafted inputs that cause rendering-time errors, potentially leading to heap corruption and application crashes.
Potential Impact
Successful exploitation of this vulnerability can cause heap corruption and crash the affected process. This impacts the stability and reliability of applications using the vulnerable MuPDF versions with barcode decoding enabled. There is no indication from the data that this leads to code execution or privilege escalation.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and consider disabling barcode decoding functionality in MuPDF if feasible to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-02-02T20:12:33.395Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69861711f9fa50a62f1b4d1e
Added to database: 02/06/2026, 16:30:09 UTC
Last enriched: 07/15/2026, 11:05:45 UTC
Last updated: 09/10/2026, 19:36:53 UTC
Views: 274
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.