PT-2026-33222 · Artifex · Mupdf Mutool

Niel Duysters · Published 2026-04-16 · Updated 2026-05-26 · CVE-2026-40505

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MuPDF mutool (affected versions not specified)

Description MuPDF mutool fails to sanitize PDF metadata fields before writing them to terminal output. This allows the injection of arbitrary ANSI escape sequences—codes used to control terminal formatting and cursor position—through crafted PDF metadata. When running the 'mutool info' command, these unsanitized codes can be used to clear the terminal display and render arbitrary text, which could facilitate social engineering attacks such as presenting fake prompts or spoofed commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2026-40505

Affected Products

Mupdf Mutool

References · 14

• https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aaca3a4dfb · Patch
• https://ubuntu.com/security/CVE-2026-40505 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40505 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-40505 · Security Note
• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfb · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40505 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40505 · Vendor Advisory
• https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0 · Note
• https://twitter.com/VulmonFeeds/status/2044648674836283493 · Twitter Post
• https://t.me/cveNotify/164734 · Telegram Post
• https://vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata · Note
• https://bugs.ghostscript.com/show_bug.cgi?id=709108 · Note
• https://twitter.com/CVEnew/status/2045112907395146011 · Twitter Post