Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40505 MuPDF mutool does not sanitize PDF metadata fields before writing them to terminal output, allowing attackers to inject arbitrary ANSI escape sequences through crafte… https://www.cve.org/CVERecord?id=CVE-2026-40505
Post summary
This post announces a sanitization flaw in MuPDF mutool that permits injection of arbitrary ANSI escape sequences via PDF metadata.
CVE-2026-40505 ANSI Escape Sequence Injection in MuPDF mutool PDF Metadata Output https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40505
Post summary
A new ANSI Escape Sequence Injection vulnerability (CVE-2026-40505) affecting MuPDF mutool PDF metadata output has been announced, but no PoC, exploit code, or mitigation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | artifex | mupdf | - | - | - |