CVE-2026-25556

The record

MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.

Affected packages

Related vulnerabilities

• CVE-2026-109271 ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the… CWE-415
• CVE-2026-107886 OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. CWE-415
• CVE-2026-107209 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-415
• CVE-2026-98154 In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO… CWE-415
• CVE-2026-87585 Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a… CWE-415
• CVE-2026-79907 Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary… CWE-415
• CVE-2026-82325 A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through… CWE-415
• CVE-2026-20510 In camera middleware, there is a possible escalation of privilege due to double free. CWE-415