MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes.

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c06fd97a53 advisory.

    mupdf 1.27.1 and dependencies

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4366b8d2d8 advisory.

    fix CVE-2026-25556 (rhbz#2437973)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in     fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function     accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path     before rethrowing the exception. Callers (including the barcode decoding path in     fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that     can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF     barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while     decoding barcodes. (CVE-2026-25556)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
299756	Fedora 43 : mupdf / python-PyMuPDF / qpdfview / zathura-pdf-mupdf (2026-c06fd97a53)	Nessus	Fedora Local Security Checks	medium
299733	Fedora 42 : mupdf (2026-4366b8d2d8)	Nessus	Fedora Local Security Checks	medium
298282	Linux Distros Unpatched Vulnerability : CVE-2026-25556	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-25556

medium

Tenable Plugins

medium

medium

medium