Bug 2558213

Summary: CVE-2026-112036 mupdf: mupdf: Denial of service via double-free in signature locking [fedora-44]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: mupdfAssignee: Michael J Gruber <mjg>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: 44CC: lizhenbo, mjg
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["1161c007-0c24-4446-ad4a-71619c9d6d61"]}
Fixed In Version: mupdf-1.28.2-4.fc46 mupdf-1.28.2-3.fc44 mupdf-1.28.2-3.fc45 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-10-23 11:40:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2555338    

Description Vladimir Vasilev 2026-10-21 11:28:33 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.

Comment 1 Fedora Update System 2026-10-23 11:31:08 UTC
FEDORA-2026-70d51c6891 (mupdf-1.28.2-4.fc46) has been submitted as an update to Fedora 46.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-70d51c6891

Comment 2 Fedora Update System 2026-10-23 11:40:11 UTC
FEDORA-2026-70d51c6891 (mupdf-1.28.2-4.fc46) has been pushed to the Fedora 46 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 3 Fedora Update System 2026-10-23 15:13:30 UTC
FEDORA-2026-dd418bdfde (mupdf-1.28.2-3.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-dd418bdfde

Comment 4 Fedora Update System 2026-10-23 15:38:25 UTC
FEDORA-2026-10ad8af11a (mupdf-1.28.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-10ad8af11a

Comment 5 Fedora Update System 2026-10-23 16:28:16 UTC
FEDORA-2026-2fd016c93c (mupdf-1.27.2-5.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-2fd016c93c

Comment 6 Fedora Update System 2026-10-24 17:26:00 UTC
FEDORA-2026-10ad8af11a has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-10ad8af11a`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-10ad8af11a

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-10-24 17:48:27 UTC
FEDORA-2026-2fd016c93c has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-2fd016c93c`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-2fd016c93c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-10-24 18:16:07 UTC
FEDORA-2026-dd418bdfde has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-dd418bdfde`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-dd418bdfde

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2026-10-26 01:08:07 UTC
FEDORA-2026-10ad8af11a (mupdf-1.28.2-3.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 10 Fedora Update System 2026-11-01 01:04:53 UTC
FEDORA-2026-dd418bdfde (mupdf-1.28.2-3.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.