The vulnerability resides in the free_char_list function of MuPDF's pdf-xref.c, where a double free can occur if the Signature Locking component processes a crafted PDF. This flaw permits an attacker to corrupt memory, and depending on the surrounding context, may lead to arbitrary code execution or application crash. The weakness reflects both buffer overflow and double free conditions, as identified by CWEs 119 and 415.

Artifex MuPDF versions up to and including 1.28.5 are affected. Any installation that uses these releases without the provided patch may be exposed.

The CVSS base score of 5.3 indicates moderate severity; a remote attacker can trigger the flaw, and the exploit is already public. Although EPSS is not available and the vulnerability is not listed in CISA KEV, the potential for remote exploitation remains. An attacker could craft a PDF to trigger the double free, leading to memory corruption and possible code execution, especially if other vulnerabilities exist in the execution environment.