VULNERABILITY INTELLIGENCE

CVE-2026-40505

CVSS score3.3 LOW
EPSS probability0.17%
CISA KEVNot currently listed
Published2026-04-16
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

Weakness classification

  • disclosure@vulncheck.com: CWE-150

Primary references