← Voltar para CVEs

CVE-2026-40505

LOW

3.3

Descricao

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

Detalhes CVE

Pontuacao CVSS v3.13.3

SeveridadeLOW

Vetor CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Vetor de ataqueLOCAL

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado4/16/2026

Ultima modificacao4/17/2026

Fontenvd

Avistamentos honeypot0

Fraquezas (CWE)

CWE-150

Referencias

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c29b41e47663be82514aaca3a4dfb(disclosure@vulncheck.com)

https://github.com/ArtifexSoftware/mupdf/commit/0f17d789fe8c29b41e47663be82514aaca3a4dfb(disclosure@vulncheck.com)

https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.