VYPR
← All advisories
Low severity3.3NVD Advisory· Published Apr 16, 2026· Updated May 26, 2026

CVE-2026-40505

CVE-2026-40505

Description

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Artifex/Mupdfreferences3 versions
    (expand)+ 2 more
    • (no CPE)
    • cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*range: <1.27.0
    • (no CPE)range: <1.27
  • MuPDF/mutoolllm-create
    Range: <1.27

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.