Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
MuPDF mutool allows attackers to clear or manipulate terminal output
CVE-2026-40505
Summary
Malicious PDFs can be used to clear or manipulate the terminal display, potentially leading to social engineering attacks. This affects anyone who uses MuPDF mutool to view PDF metadata. To minimize risk, ensure you are running the latest version of MuPDF mutool and do not use it to view untrusted PDFs.
Original title
MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicio...
Original description
MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.
nvd CVSS3.1
3.3
nvd CVSS4.0
4.8
Vulnerability type
CWE-150
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c2...
- https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata
- https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aa...
- https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0
Published: 16 Apr 2026 · Updated: 17 Apr 2026 · First seen: 16 Apr 2026