Medium 5.9Published Feb 6, 2026

CVE-2026-25556MuPDF 1.23.0 through 1.27.0 Barcode Decoding Double Free

Updated under an hour ago (Oct 27, 2026, 7:40 PM ET)

Does this affect you?

It affects Artifex Software MuPDF and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Artifex Software MuPDF

Exploited in the last 30 days

MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.

CVSS: 5.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-415
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Analyzed
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Artifex Software MuPDF artifex_software:mupdf (from the name)	from 1.23.0 through 1.27.0	CNA record
artifex mupdf artifex:mupdf	from 1.23.0 through 1.27.0	NVD

References

References

https://bugs.ghostscript.com/show_bug.cgi?id=709029	issue-tracking, exploit
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1	patch
https://mupdf.com/	product
https://www.vulncheck.com/advisories/mupdf-barcode-decoding-double-free	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.