CVE-2026-112036

Name	CVE-2026-112036
Description	A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mupdf (PTS)	bookworm, bookworm (security)	1.21.1+ds2-1+deb12u1	vulnerable
	trixie (security), trixie	1.25.1+ds1-6+deb13u1	vulnerable
	forky, sid	1.28.2+ds1-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mupdf	source	(unstable)	(unfixed)

https://bugs.ghostscript.com/show_bug.cgi?id=709768
Fixed by: http://www.ghostscript.com/cgi-bin/findgit.cgi?3984925b660afb8a781ddf504021e91be1bc671e