CVE-2026-112036 Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
A double free vulnerability in MuPDF's signature locking allows remote attackers to cause denial of service or potentially execute code via crafted PDF files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-112036?
CVE-2026-112036 is a medium-severity use after free vulnerability in Artifex MuPDF, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
Which versions are affected by CVE-2026-112036?
How do I fix CVE-2026-112036?
No fix has been published for CVE-2026-112036 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-112036 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112036 exists.
Sources
Also known as DEBIAN-CVE-2026-112036, GHSA-pv37-v42r-g3rq, UBUNTU-CVE-2026-112036.