Live › vulnerability › CVE-2026-120752
PyMuPDF 1.25.3 before 2.0 has a stack-based buffer overflow in JM_set_annot_callout_line(), which copies a caller-supplied number of callout points into a fixed three-element array. An attacker who controls the callout argument to Page.add_freetext_annot() can crash the process or execute code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 23:35 UTC. All times on this page are UTC.
Applications that use PyMuPDF 1.25.3 or earlier 2.0 releases to add FreeText annotations with callout lines, especially where the callout points come from user-supplied documents or requests. Code that never passes attacker-controlled callout data to Page.add_freetext_annot() is much less exposed. unknown whether other PyMuPDF call paths are affected.
No product ranges from the sources yet.
pip show PyMuPDF and look for 1.25.3 or any version before 2.0.Page.add_freetext_annot() that pass callout points from untrusted input.2.0 or later, per the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.
This page as .md · .json · in your agent: get_signal("CVE-2026-120752")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.