CVE-2026-25556

Name	CVE-2026-25556
Description	MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1127318

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mupdf (PTS)	bullseye	1.17.0+ds1-2	fixed
	bullseye (security)	1.17.0+ds1-2+deb11u1	fixed
	bookworm	1.21.1+ds2-1	fixed
	trixie	1.25.1+ds1-6	vulnerable
	forky, sid	1.27.0+ds1-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
mupdf	source	bullseye	(not affected)
mupdf	source	bookworm	(not affected)
mupdf	source	(unstable)	(unfixed)	1127318

Notes

[trixie] - mupdf <no-dsa> (Minor issue)
[bookworm] - mupdf <not-affected> (Vulnerable code introduced later)
[bullseye] - mupdf <not-affected> (Vulnerable code introduced later)
https://bugs.ghostscript.com/show_bug.cgi?id=709029
Introduced with: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=c810149dfd28799cf7f6b40043645cade9bf02b8 (1.23.0-rc1)
Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1