Is CVE-2026-25556 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25556 being exploited in the wild.

How severe is CVE-2026-25556?

High severity, with a CVSS score of 7.5, published 6 February 2026.

Which products and versions are affected?

Artifex Software MuPDF 1.23.0 through 1.27.0.

Is there a fix for CVE-2026-25556?

A patch was published on 2026-01-13: Fix committed to MuPDF repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25556 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25556?

Check whether you run Artifex Mupdf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25556: Artifex MuPDF double free in fz_fill_pixmap_from_display_list

CVE-2026-25556 · Severity: high · CVSS 7.5 · Published 2026-02-06

MuPDF is a widely used library for viewing and managing PDF documents and other file formats. A vulnerability in its barcode decoding component could allow an attacker to crash applications using the library by providing a specially crafted document. This could lead to a service outage or application instability, though it primarily affects software that has specifically enabled barcode support.

Technologies: Artifex Mupdf. Vendors: Artifex.

Quick answers

Is CVE-2026-25556 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25556 being exploited in the wild.
How severe is CVE-2026-25556?: High severity, with a CVSS score of 7.5, published 6 February 2026.
Which products and versions are affected?: Artifex Software MuPDF 1.23.0 through 1.27.0.
Is there a fix for CVE-2026-25556?: A patch was published on 2026-01-13: Fix committed to MuPDF repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25556 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25556?: Check whether you run Artifex Mupdf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A double-free vulnerability exists in the fz_fill_pixmap_from_display_list() function within MuPDF. The function incorrectly assumes ownership of a caller-provided fz_pixmap pointer and releases it during error handling (fz_catch block) before rethrowing the exception. When the caller subsequently attempts to release the same pixmap during its own cleanup, a double-free occurs. This is primarily reachable via fz_decode_barcode_from_display_list() when processing crafted input that triggers a rendering-time error. While the vulnerability is present in the source, exploitability is limited as barcode support (zxing-cpp) is disabled by default in standard MuPDF builds. A patch is available in the project's Git repository.

Affected products

Artifex Software MuPDF 1.23.0 through 1.27.0

Timeline

2026-01-12: disclosed: Vulnerability reported by Pavel Kohout
2026-01-13: patched: Fix committed to MuPDF repository
2026-02-06: advisory: Public disclosure of CVE-2026-25556

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.