CVE-2026-40505

Katalog CVE

CVSS 3.3 · Low EPSS 0,19%

Kerentanan Improper Neutralization of Escape, Meta, or Control Sequences pada artifex mupdf. Skor CVSS 3.1 3.3 (Low) menurut vulncheck.com.

Deskripsi (NVD)

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

Rincian

Terbit di NVD

16 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfb patch
• https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aaca3a4dfb patch
• https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata advisory pihak ketiga
• https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0 product