The vulnerability arises in MuPDF versions 1.23.0 through 1.27.0 when an exception occurs during display list rendering while processing a barcode. The function fz_fill_pixmap_from_display_list incorrectly frees a caller‑owned pixmap in its error path, and the caller later frees the same pixmap in cleanup, producing a double‑free. This flaw allows heap corruption and can terminate the application.

MuPDF, a PDF and XPS rendering engine from Artifex Software, is affected for all releases from 1.23.0 up to and including 1.27.0. Applications that enable MuPDF barcode decoding and process user documents are therefore impacted.

The CVSS score is 5.9 and the EPSS score is under 1 %, indicating a low likelihood of active exploitation. The flaw is not listed in the CISA KEV catalog. An attacker can trigger the issue by delivering a specially crafted document that causes a rendering-time error during barcode decoding. This results in a deterministic heap corruption that usually crashes the process, affecting availability and potentially enabling further exploitation if additional vulnerabilities exist. The primary attack vector therefore requires the attacker to supply malicious content to a MuPDF‑using application.