AEGLIX vulnerability intelligence
CVE-2026-112036
LOW · CVSS 2.1 · Deferred
Published: 2026-10-19 · Updated: 2026-10-19 · Source: NVD
Vulnerability overview
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
Severity and scoring
- CVSS score
- 2.1 · LOW
- CVSS version
- 4.0
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weaknesses
- CWE-119, CWE-415
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Not listed in the CISA catalog retrieved for this record. This does not establish that exploitation has not occurred.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
NVD has not supplied affected-version configurations for this record. Check the vendor references below.
Advisories and references
- http://www.ghostscript.com/cgi-bin/findgit.cgi?3984925b660afb8a781ddf504021e91be1bc671e
- https://artifex.com/
- https://bugs.ghostscript.com/attachment.cgi?id=28609
- https://bugs.ghostscript.com/show_bug.cgi?id=709768
- https://vuldb.com/cve/CVE-2026-112036
- https://vuldb.com/submit/1008495
- https://vuldb.com/vuln/421684
- https://vuldb.com/vuln/421684/cti