CVE-2026-120752

high

Description

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.

References

https://www.vulncheck.com/advisories/pymupdf-1.25.3-before-2.0-stack-buffer-overflow-via-add-freetext-annot-callout

https://github.com/pymupdf/PyMuPDF/releases/tag/2.0

https://github.com/pymupdf/PyMuPDF/issues/5173

https://github.com/pymupdf/PyMuPDF/issues/5112

https://github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae1c9065c81cd9a275a1b092f5e

https://github.com/pymupdf/PyMuPDF/blob/1.28.2/src/extra.i#L787-L797

https://github.com/pymupdf/PyMuPDF

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-115640

Details

Source: Mitre, NVD

Published: 2026-11-02

Updated: 2026-11-02

Risk Information

CVSS v2

Base Score: 7.1

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 7.7

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High