Stack-Based Buffer Overflow in PyMuPDF Affects Versions Before 2.0
CVE-2026-120752

7.7HIGH

Key Information:

Vendor

PymuPDF

Status
PymuPDF
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120752?

A stack-based buffer overflow vulnerability exists in PyMuPDF versions prior to 2.0 within the JM_set_annot_callout_line() function. An attacker can exploit this flaw by supplying a caller-defined number of callout points through the Page.add_freetext_annot() method. If input exceeds the expected three callout points, it can overwrite the stack frame, leading to potential process crashes or the execution of arbitrary code.

Affected Version(s)

PyMuPDF 1.25.3 < 2.0

References

https://github.com/pymupdf/PyMuPDF/issues/5112
issue-tracking
https://github.com/pymupdf/PyMuPDF/issues/5173
issue-trackingtechnical-description
https://github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae...
patch

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

k3rn3lbr3ach3r
Dilanka Kaushal Hewage (r3vpwnx)
.