CVE-2026-40505 is an ANSI injection vulnerability in Artifex Software Inc.'s MuPDF prior to version 1.27. The issue arises because mutool processes PDF metadata fields without properly neutralizing ANSI escape sequences, allowing crafted PDFs to embed malicious ANSI codes. These codes are then output directly to the terminal when using mutool info, enabling attackers to alter terminal display behavior. This vulnerability is categorized under CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences) and has a CVSS 4.8 (medium) score, indicating moderate risk primarily due to the potential for social engineering rather than direct system compromise. No patch or official fix has been documented yet.

The vulnerability allows attackers to inject ANSI escape sequences into terminal output via PDF metadata processed by mutool. This can be leveraged to manipulate terminal display, potentially deceiving users with fake prompts or spoofed commands. While this does not directly allow code execution or privilege escalation, it poses a risk of social engineering attacks that could lead to further compromise if users are tricked into executing malicious commands.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when running mutool info on untrusted PDF files. Avoid processing PDFs from untrusted sources with mutool or consider running mutool in a restricted or isolated environment to limit potential impact.