CVE-2026-40505 MuPDF < 1.27 mutool ANSI Injection via Metadata

Q: What is CVE-2026-40505?

CVE-2026-40505 is a medium-severity vulnerability in Artifex Mupdf, published on 16 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Q: Is CVE-2026-40505 being exploited?

There is no known exploitation of CVE-2026-40505 in the wild and no public exploit code.

Medium 4.8 Published 16 Apr 2026 Updated 14 Jul 2026

Attackers can inject ANSI escape sequences via PDF metadata to manipulate terminal display in mutool, facilitating social engineering attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-40505?

CVE-2026-40505 is a medium-severity vulnerability in Artifex Mupdf, published on 16 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

Weakness: CWE-150

Which versions are affected by CVE-2026-40505?

It affects 1 product.

Products include Artifex Mupdf.

How do I fix CVE-2026-40505?

Upgrade to a fixed version.

Is CVE-2026-40505 being exploited?

There is no known exploitation of CVE-2026-40505 in the wild and no public exploit code.

All Artifex Mupdf vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-40505, GHSA-hj44-m5xv-x75q, UBUNTU-CVE-2026-40505.