CVE-2026-25556
Description
A flaw was found in MuPDF. An attacker can exploit a double-free vulnerability in the fz_fill_pixmap_from_display_list() function by processing crafted input that causes a rendering-time error during barcode decoding. This can lead to heap corruption and a process crash, resulting in a Denial of Service (DoS).
Statement
This MODERATE impact vulnerability in MuPDF affects applications that utilize its barcode decoding functionality. The flaw can be triggered when processing specially crafted input that causes a rendering error during barcode decoding, leading to a double-free and potential application crash. Red Hat products are affected if they enable and use MuPDF for barcode decoding.
Mitigation
To mitigate this issue, avoid processing untrusted or unverified input with applications that use MuPDF for barcode decoding. Restricting the sources of documents processed by MuPDF can reduce the risk of exploitation.
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands
This weakness may result in the corruption of memory, and perhaps instructions, possibly leading to a crash. If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
