Logo
›
›vulnerability›CVE-2026-40505
Name
CVE-2026-40505
Source
NVD ( link)Debian ( link)
Description
MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.
CWEs
CWE-150
Published Date
Updated Date
Workaround
-
Advisories
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfbPatch
https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aaca3a4dfbPatch
https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0Product
https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadataThird Party Advisory

Analysis#

Affected Component
Analysis
mupdf
Exploitable

Vulnerability Ratings#

4.8
CVSSv4
3.3
CVSSv31
NaN
other

Others affected component#

Name
Project
Project Version
Version
Status
mupdf
buildroot
master
1.23.9
Exploitable