CVE-2026-40505 is a vulnerability in Artifex Software Inc.'s MuPDF mutool where PDF metadata fields are not properly sanitized before being written to terminal output. This improper neutralization of escape sequences (CWE-150) enables attackers to embed malicious ANSI escape codes in PDF metadata. When processed by mutool info, these escape sequences can manipulate the terminal display, potentially misleading users through social engineering techniques such as fake prompts or spoofed commands. The vulnerability affects MuPDF versions indicated as '0' (likely meaning initial or unspecified versions). The CVSS 4.8 score reflects a medium severity with local attack vector and user interaction required.

An attacker can craft a PDF with malicious metadata that, when inspected using mutool info, injects ANSI escape sequences into the terminal output. This can clear the terminal screen and display arbitrary text, potentially tricking users into executing unintended commands or divulging sensitive information. The impact is primarily social engineering rather than direct code execution or system compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when running mutool info on untrusted PDF files. Avoid opening or inspecting PDFs from untrusted sources with mutool. Monitor Artifex Software Inc. advisories for updates or patches addressing this issue.