Is CVE-2026-40505 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40505 being exploited in the wild.

How severe is CVE-2026-40505?

Low severity, with a CVSS score of 3.3, published 16 April 2026.

Which products and versions are affected?

Artifex Software MuPDF < 1.27.0.

Is there a fix for CVE-2026-40505?

A patch was published on 2026-02-09: Initial patch committed to source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40505 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-40505?

Check whether you run Artifex Mupdf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40505: Artifex MuPDF ANSI injection in mutool via PDF metadata

Q: Is there a fix for CVE-2026-40505?

A patch was published on 2026-02-09: Initial patch committed to source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40505 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-40505?

Check whether you run Artifex Mupdf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40505 · Severity: low · CVSS 3.3 · Published 2026-04-16

MuPDF is a lightweight document viewer and toolkit used for processing PDF and XPS files. A vulnerability in its command-line utility, mutool, allows a specially crafted PDF file to manipulate the user's terminal display. If a user runs the tool on a malicious file, an attacker could hide information or display fake prompts to trick the user into performing dangerous actions.

Technologies: Artifex Mupdf. Vendors: Artifex.

Quick answers

Is CVE-2026-40505 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40505 being exploited in the wild.
How severe is CVE-2026-40505?: Low severity, with a CVSS score of 3.3, published 16 April 2026.
Which products and versions are affected?: Artifex Software MuPDF < 1.27.0.
Is there a fix for CVE-2026-40505?: A patch was published on 2026-02-09: Initial patch committed to source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40505 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-40505?: Check whether you run Artifex Mupdf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An ANSI injection vulnerability exists in the 'mutool' utility of MuPDF versions prior to 1.27.0. The root cause is the improper neutralization of escape sequences (CWE-150) within PDF metadata fields, specifically font names, which are passed unsanitized to the terminal output during the execution of 'mutool info'. A local attacker can exploit this by providing a victim with a maliciously crafted PDF file. When the victim processes the file using mutool, the embedded ANSI escape codes can clear the terminal, reposition the cursor, or spoof command prompts, facilitating social engineering attacks. The issue was addressed in version 1.27.0 by using the '%q' format specifier to properly quote and sanitize font names before output.

Affected products

Artifex Software MuPDF < 1.27.0

Timeline

2026-02-09: patched: Initial patch committed to source repository
2026-04-15: advisory: VulnCheck published advisory
2026-04-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.