Executive brief
MuPDF is a lightweight document viewer and toolkit used for processing PDF and XPS files. A vulnerability in its command-line utility, mutool, allows a specially crafted PDF file to manipulate the user's terminal display. If a user runs the tool on a malicious file, an attacker could hide information or display fake prompts to trick the user into performing dangerous actions.
Technical details
An ANSI injection vulnerability exists in the 'mutool' utility of MuPDF versions prior to 1.27.0. The root cause is the improper neutralization of escape sequences (CWE-150) within PDF metadata fields, specifically font names, which are passed unsanitized to the terminal output during the execution of 'mutool info'. A local attacker can exploit this by providing a victim with a maliciously crafted PDF file. When the victim processes the file using mutool, the embedded ANSI escape codes can clear the terminal, reposition the cursor, or spoof command prompts, facilitating social engineering attacks. The issue was addressed in version 1.27.0 by using the '%q' format specifier to properly quote and sanitize font names before output.
Affected products
- Artifex Software MuPDF < 1.27.0
Timeline
- 2026-02-09: patched: Initial patch committed to source repository
- 2026-04-15: advisory: VulnCheck published advisory
- 2026-04-16: disclosed: CVE published to NVD
References
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfb
- https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aaca3a4dfb
- https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0
- https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata