# CVE-2026-112036: Artifex MuPDF double free in signature locking

Source: https://junglewise.ai/threats/cve-2026-112036-a-vulnerability-was-detected-in-artifex-mupdf-up-to-1-28-5-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112036 · Severity: medium · CVSS 4.3 · Published 2026-10-19

MuPDF is a lightweight PDF reader and library used in applications that display and process PDF documents. A double-free vulnerability in the signature locking component allows a remote attacker to crash an application or potentially execute arbitrary code by crafting a malicious PDF file. The flaw affects MuPDF versions up to 1.28.5, and exploit code is publicly available.

Technologies: [Artifex Mupdf](https://junglewise.ai/threats/technologies/mupdf). Vendors: [Artifex](https://junglewise.ai/threats/vendors/artifex).

## Quick answers

**Is CVE-2026-112036 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112036 being exploited in the wild.

**How severe is CVE-2026-112036?** Medium severity, with a CVSS score of 4.3, published 19 October 2026.

**Which products and versions are affected?** Artifex Mupdf up to 1.28.5.

**Is there a fix for CVE-2026-112036?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112036 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-112036?** Check whether you run Artifex Mupdf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a double-free memory corruption bug in the free_char_list function of source/pdf/pdf-xref.c, affecting the Signature Locking component. The flaw can be triggered remotely by sending a specially crafted PDF, with no authentication or user interaction required beyond opening the file. An attacker gains the ability to crash the application (denial of service) or potentially achieve code execution.

## Affected products

- Artifex MuPDF up to 1.28.5

## Timeline

- 2026-10-19: disclosed
- exploited: Exploit is public

## References

- [http://www.ghostscript.com/cgi-bin/findgit.cgi?3984925b660afb8a781ddf504021e91be1bc671e](http://www.ghostscript.com/cgi-bin/findgit.cgi?3984925b660afb8a781ddf504021e91be1bc671e)
- [https://artifex.com/](https://artifex.com/)

## Related threats

- [Artifex MuPDF null pointer dereference in PDF Xref loading](https://junglewise.ai/threats/cve-2026-92413-artifex-mupdf-null-pointer-dereference-in-pdf-xref-loading)
- [A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function…](https://junglewise.ai/threats/cve-2026-7233-a-vulnerability-was-determined-in-artifex-mupdf-up-to-1-28-0-the)
- [Artifex MuPDF ANSI injection in mutool via PDF metadata](https://junglewise.ai/threats/cve-2026-40505-artifex-mupdf-ansi-injection-in-mutool-via-pdf-metadata)
- [Artifex MuPDF double free in fz_fill_pixmap_from_display_list](https://junglewise.ai/threats/cve-2026-25556-artifex-mupdf-double-free-in-fz-fill-pixmap-from-display-list)
- [Artifex MuPDF denial of service in mutool clean utility](https://junglewise.ai/threats/cve-2025-46206-artifex-mupdf-denial-of-service-in-mutool-clean-utility)