Description

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

INFO

Published Date :

2026-04-16T01:20:08.397Z

Last Modified :

2026-04-17T16:32:45.810Z

Source :

VulnCheck
AFFECTED PRODUCTS

The following products are affected by CVE-2026-40505 vulnerability.

Vendors Products
Artifex
  • Mupdf
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40505.

URL Resource
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfb cve-icon cve-icon
https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aaca3a4dfb cve-icon cve-icon
https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0 cve-icon cve-icon
https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact