---
id: CVE-2026-40505
title: MuPDF < 1.27 mutool ANSI Injection via Metadata
summary: >-
  MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that
  allows attackers to inject arbitrary ANSI escape sequences through crafted PDF
  metadata fields. Attackers can embed malicious ANSI escape codes in PDF
  metadata tha…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-150
vendor: Artifex Software Inc.
product: MuPDF
affected:
  - MuPDF < 1.27.0
  - MuPDF 0f17d789fe8c29b41e47663be82514aaca3a4dfb
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-16T13:53:13.801290Z'
published: '2026-04-16'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:51.444Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-40505'
references:
  - url: 'https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0'
    label: MuPDF 1.27.0 Release Notes
  - url: >-
      https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aaca3a4dfb
  - url: >-
      https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfb
  - url: >-
      https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata
tags:
  - cve.org
epss: 0.00166
epssPercentile: 0.05907
ingestedAt: '2026-11-08T14:51:22.442Z'
---

## Overview

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

## Affected

- `MuPDF < 1.27.0`
- `MuPDF 0f17d789fe8c29b41e47663be82514aaca3a4dfb`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.