Description
MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Artifex Software | MuPDF | 1.23.0 – ≤ 1.27.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mupdf | 1.27.0+ds1-3 | — |
| Debian 13 | mupdf | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | mupdf | No fix yet | — |
| Ubuntu 26.04 LTS | mupdf | No fix yet | — |
| Ubuntu 25.10 | mupdf | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | mupdf | No fix yet | — |
| Ubuntu Pro 22.04 LTS | mupdf | No fix yet | — |
| Ubuntu Pro 20.04 LTS | mupdf | No fix yet | — |
| Ubuntu Pro 18.04 LTS | mupdf | No fix yet | — |
| Ubuntu Pro 16.04 LTS | mupdf | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mupdf | 1.27.1-1.1 | openSUSE-SU-2026:10214-1 |
| openSUSE Leap 16.0 | mupdf | 1.27.2-bp160.1.1 | openSUSE-SU-2026:21180-1 |
Advisories 2
- openSUSE-SU-2026:21180-1 Security update for mupdf SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:10214-1 mupdf-1.27.1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
References
- https://bugs.ghostscript.com/show_bug.cgi?id=709029 issue-tracking
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1 patch
- https://mupdf.com/ product
- https://www.vulncheck.com/advisories/mupdf-barcode-decoding-double-free third-party-advisory