CVE-2026-40505: 
NixOS vulnerability analysis and mitigation

CVE-2026-40505 is an ANSI escape sequence injection vulnerability in MuPDF's mutool command-line utility that allows attackers to manipulate terminal output through crafted PDF metadata fields. Affecting MuPDF versions before 1.27.0, the flaw was disclosed on April 16, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of escape, meta, or control sequences (CWE-150) combined with improper output neutralization for logs (CWE-117). Specifically, mutool info in source/tools/pdfinfo.c printed raw font names and other PDF metadata fields directly to terminal output using an unquoted format string (%s), without sanitizing embedded ANSI escape codes. The fix, applied in commit 0f17d789fe8c29b41e47663be82514aaca3a4dfb, changed the format specifier to %q to properly quote the font name before output (GitHub Commit). Exploitation requires a victim to run mutool info against an attacker-controlled PDF file, making user interaction a prerequisite (GitHub Advisory).

Successful exploitation allows an attacker to inject arbitrary ANSI escape sequences into the victim's terminal session, enabling terminal display manipulation such as clearing the screen and rendering fake prompts or spoofed commands. The primary risk is social engineering — an attacker could deceive a user into believing they are interacting with a legitimate system prompt, potentially leading to credential theft or execution of malicious commands. There is no direct confidentiality or availability impact; the integrity impact is limited to the terminal display context (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0th percentile), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Craft a malicious PDF: Create a PDF file with metadata fields (e.g., font name) containing embedded ANSI escape sequences, such as \x1b[2J\x1b[H (clear screen and move cursor to home) followed by arbitrary text mimicking a system prompt or sudo password request.
2. Deliver the PDF to the target: Distribute the crafted PDF to a victim via email, file share, or download — any method that results in the victim having the file locally.
3. Induce victim to run mutool info: Social-engineer or otherwise cause the victim to execute mutool info <malicious.pdf> on a terminal that interprets ANSI escape codes (e.g., most Linux/macOS terminals).
4. Terminal manipulation occurs: When mutool info processes the PDF and outputs font metadata, the unsanitized ANSI sequences are interpreted by the terminal, clearing the display and rendering attacker-controlled text such as a fake password prompt.
5. Social engineering objective achieved: The victim, seeing a convincing fake prompt, may enter credentials or execute commands as directed by the spoofed output (GitHub Advisory, GitHub Commit).

• File System: Presence of PDF files with unusual or non-printable characters embedded in metadata fields (font names, author, title, etc.), detectable via PDF metadata inspection tools.
• Process: Execution of mutool info against PDF files from untrusted or external sources, particularly if followed by unexpected terminal behavior or user-reported screen clearing.
• Logs: Shell history or audit logs (e.g., auditd) showing mutool info invocations on files received from external parties.

Upgrade MuPDF to version 1.27.0 or later, which includes the fix applied in commit 0f17d789fe8c29b41e47663be82514aaca3a4dfb that sanitizes font name output using the %q format specifier (GitHub Release, GitHub Commit). As a workaround, avoid running mutool info on PDF files from untrusted sources. Security teams should also consider restricting access to mutool in environments where untrusted PDFs may be processed.

Red Hat triaged the issue as low severity and opened a tracking bug in their Bugzilla system (Red Hat Bugzilla). VulnCheck was credited as the assigning authority for this CVE and published an advisory describing the attack scenario (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been observed.