CVE-2026-40505

Name	CVE-2026-40505
Description	MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1134199

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mupdf (PTS)	bullseye	1.17.0+ds1-2	vulnerable
	bullseye (security)	1.17.0+ds1-2+deb11u2	vulnerable
	bookworm	1.21.1+ds2-1	vulnerable
	bookworm (security)	1.21.1+ds2-1+deb12u1	vulnerable
	trixie	1.25.1+ds1-6	vulnerable
	trixie (security)	1.25.1+ds1-6+deb13u1	vulnerable
	forky, sid	1.27.0+ds1-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mupdf	source	(unstable)	1.27.0+ds1-5			1134199

Notes

[trixie] - mupdf <no-dsa> (Minor issue)
[bookworm] - mupdf <no-dsa> (Minor issue)
[bullseye] - mupdf <no-dsa> (Minor issue)
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfb
https://bugs.ghostscript.com/show_bug.cgi?id=709108