CVE-2026-40505: MuPDF mutool XSS Vulnerability

CVE-2026-40505 Overview

CVE-2026-40505 is an input validation vulnerability in MuPDF's mutool utility that fails to sanitize PDF metadata fields before writing them to terminal output. This flaw allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata, enabling terminal manipulation attacks that can be leveraged for social engineering purposes.

When users execute mutool info on a maliciously crafted PDF file, the embedded ANSI escape codes in the document's metadata are passed directly to the terminal without sanitization. This enables attackers to clear the terminal display and render arbitrary text, potentially presenting fake prompts or spoofed commands to deceive users.

Critical Impact

Attackers can manipulate terminal output through crafted PDF files to display fake prompts, spoofed commands, or misleading information for social engineering attacks.

Affected Products

• MuPDF mutool (versions prior to the security patch)

Discovery Timeline

• April 16, 2026 - CVE-2026-40505 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40505

Vulnerability Analysis

This vulnerability is classified under CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences). The core issue stems from MuPDF's mutool info command directly outputting PDF metadata fields to the terminal without first filtering or escaping potentially dangerous control characters.

PDF documents contain various metadata fields such as Title, Author, Subject, Keywords, Creator, Producer, and creation/modification dates. These fields are typically strings that users expect to contain human-readable text. However, the PDF specification does not restrict what characters can be included in these fields, allowing malicious actors to embed ANSI escape sequences.

ANSI escape sequences are special character combinations that terminals interpret as commands rather than displayable text. When mutool info outputs metadata containing these sequences, the terminal executes them, giving attackers control over what the user sees on their screen.

Root Cause

The root cause is the absence of output sanitization in the mutool info command's metadata display functionality. When processing PDF metadata, the code retrieves string values from the document and passes them directly to printf() or similar output functions without checking for or escaping control characters. This violates the principle of treating all external input as potentially malicious, particularly when that input will be rendered in a context (the terminal) where certain character sequences have special meaning.

Attack Vector

The attack requires local access and user interaction. An attacker must craft a malicious PDF file with ANSI escape codes embedded in one or more metadata fields and then convince a target user to run mutool info against the file. The attack scenario typically involves:

1. The attacker creates a PDF document with malicious ANSI escape sequences in metadata fields such as Title or Author
2. The PDF is delivered to the target through email, file sharing, or other means
3. The victim runs mutool info malicious.pdf to inspect the document's properties
4. The terminal interprets the escape sequences, potentially clearing the screen and displaying attacker-controlled text
5. The fake output could instruct the user to run dangerous commands or reveal sensitive information

This type of terminal manipulation attack can display fake sudo prompts, fabricated error messages demanding administrative actions, or spoofed command outputs that mislead users about the state of their system.

Detection Methods for CVE-2026-40505

Indicators of Compromise

• PDF files with unusual escape sequences (starting with \\x1b[ or \033[) in metadata fields
• User reports of unexpected terminal behavior after running mutool info
• PDF documents with metadata containing non-printable ASCII characters or control sequences
• Unusual strings in PDF Title, Author, Subject, or other metadata fields that contain bracket sequences

Detection Strategies

• Implement file scanning rules to detect ANSI escape sequences in PDF metadata fields
• Monitor for PDF files with metadata containing the hexadecimal byte 0x1B (ESC character)
• Deploy endpoint detection rules that flag PDFs with unusual control characters in document properties
• Use YARA rules to identify PDF files containing escape sequence patterns in metadata streams

Monitoring Recommendations

• Log and alert on mutool info executions against PDF files from untrusted sources
• Implement terminal logging to capture unexpected escape sequence injection attempts
• Monitor for user-reported incidents of terminal display anomalies following PDF inspection
• Review PDF files in secure environments before allowing mutool operations

How to Mitigate CVE-2026-40505

Immediate Actions Required

• Update MuPDF to a patched version that includes the security fix
• Avoid running mutool info on PDF files from untrusted sources until patched
• Consider using alternative PDF metadata inspection tools that properly sanitize output
• Review and inspect PDF files in sandboxed environments before processing

Patch Information

The MuPDF development team has addressed this vulnerability in a Git commit that implements proper sanitization of metadata fields before terminal output. Users should update to the latest version of MuPDF that includes this fix. Additional details are available in the VulnCheck Advisory.

Workarounds

• Pipe mutool info output through cat -v to visualize non-printable characters: mutool info file.pdf | cat -v
• Use terminal emulators with escape sequence filtering capabilities
• Inspect PDF metadata using GUI-based tools that don't interpret ANSI sequences
• Set terminal environment variables to disable escape sequence interpretation where possible
• Process PDF files only in isolated environments or containers when handling untrusted documents