Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-06 | 1 | Disclosure1 |
| 2026-02-22 | 1 | Disclosure1 |
| 2026-02-23 | 3 | Patch3 |
CVE-2026-25556 MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering.… https://www.cve.org/CVERecord?id=CVE-2026-25556
Post summary
The text announces a double‑free vulnerability in MuPDF 1.23.0 through 1.27.0, affecting the fz_fill_pixmap_from_display_list() function during display list rendering.
#Fedora 43: MuPDF 1.27.1 is out with a critical fix for CVE-2026-25556 (double-free in barcode decoding). Affects zathura-pdf-mupdf & PyMuPDF. Don't let a malicious PDF crash your heap. Read more: 👉https://tinyurl.com/3fkezbf9 #Security https://t.co/vAT7V32yBp
Post summary
The tweet announces that Fedora 43 includes a critical patch for CVE‑2026‑25556, a double‑free bug in MuPDF’s barcode decoding, and urges users to update to MuPDF 1.27.1.
Critical #Security advisory for the Fedora community: CVE-2026-25556 is a DoS vulnerability in PyMuPDF that can be triggered via crafted barcode decoding. If you're running #Fedora 43, the path to mitigation is upgrading to mupdf 1.27.1. Read more: 👉https://tinyurl.com/39bk5rw7 https://t.co/rtNJXtAZTf
Post summary
Fedora advisory warns of CVE-2026-25556, a DoS flaw in PyMuPDF triggered by crafted barcodes, and recommends upgrading to mupdf 1.27.1 to mitigate.
Critical security patch for #Fedora 43: MuPDF 1.27.1 is out. This update addresses CVE-2026-25556, a denial-of-service vulnerability triggered by malicious files during barcode decoding. Read more: 👉 https://tinyurl.com/2neuuw7p #Security https://t.co/QKZ2XQKvGn
Post summary
Fedora 43 users should update MuPDF to version 1.27.1 to mitigate CVE-2026-25556, a denial‑of‑service vulnerability triggered by malicious barcode files.
Critical MuPDF vulnerability (CVE-2026-25556) lands for #Fedora 42. This isn't just a viewer issue—it's a DoS risk in a core parsing library. Read more: 👉 https://tinyurl.com/tnrw9wpn #Security https://t.co/ajllrI0W7h
Post summary
A critical DoS vulnerability in MuPDF (CVE-2026-25556) affecting Fedora 42 has been disclosed, emphasizing its impact on a core parsing library.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | artifex | mupdf | - | - | - |