Executive brief
MuPDF is a widely used library for viewing and managing PDF documents and other file formats. A vulnerability in its barcode decoding component could allow an attacker to crash applications using the library by providing a specially crafted document. This could lead to a service outage or application instability, though it primarily affects software that has specifically enabled barcode support.
Technical details
A double-free vulnerability exists in the fz_fill_pixmap_from_display_list() function within MuPDF. The function incorrectly assumes ownership of a caller-provided fz_pixmap pointer and releases it during error handling (fz_catch block) before rethrowing the exception. When the caller subsequently attempts to release the same pixmap during its own cleanup, a double-free occurs. This is primarily reachable via fz_decode_barcode_from_display_list() when processing crafted input that triggers a rendering-time error. While the vulnerability is present in the source, exploitability is limited as barcode support (zxing-cpp) is disabled by default in standard MuPDF builds. A patch is available in the project's Git repository.
Affected products
- Artifex Software MuPDF 1.23.0 through 1.27.0
Timeline
- 2026-01-12: disclosed: Vulnerability reported by Pavel Kohout
- 2026-01-13: patched: Fix committed to MuPDF repository
- 2026-02-06: advisory: Public disclosure of CVE-2026-25556