CVE-2026-112036 affects Artifex MuPDF versions up to 1.28.5, where the free_char_list function used in its signature-locking code can trigger a double-free condition when manipulated. The flaw is reportedly exploitable remotely, and a working exploit has already been made public. A patch addressing the issue has been released, and administrators running MuPDF are advised to update as soon as possible.
// source: nvd.nist.gov ↗