| शीर्षक | MuPDF 1.28.5 Double Free |
|---|
| विवरण | MuPDF contains a double-free vulnerability (CWE-415) in the signature locking code. The free_char_list() function frees the backing array c->list but leaves the pointer dangling. When mutool sign processes a malicious PDF whose signature widget contains crafted /V/Reference lock specifications, merge_lock_specification() can free fields->includes.list while handling /Action /All, and pdf_drop_locked_fields() later frees the same pointer again. This causes a deterministic crash / denial of service. In server-side or automated signing workflows that sign untrusted PDFs, the issue may be remotely triggerable. |
|---|
| स्रोत | ⚠️ https://bugs.ghostscript.com/show_bug.cgi?id=709768 |
|---|
| उपयोगकर्ता | suyuanwang (UID 101634) |
|---|
| सबमिशन | 30/09/2026 07:34 PM (1 महीना पहले) |
|---|
| संयम | 18/10/2026 11:12 AM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 421684 [Artifex MuPDF तक 1.28.5 Signature Locking source/pdf/pdf-xref.c free_char_list बफ़र ओवरफ़्लो] |
|---|
| अंक | 17 |
|---|