CVE-2026-120752: PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout

Q: Who is exposed to this issue?

Applications using affected PyMuPDF versions are exposed if an attacker can control the callout argument supplied to Page.add_freetext_annot(). The listed affected software includes PyMuPDF packages for Ubuntu and Debian.

Q: What does exploitation require?

The attacker needs the ability to provide four or more callout points to Page.add_freetext_annot(). No user interaction is required, but the attacker must have the privileges needed to influence that application input.

Q: What is the impact of a successful exploit?

Supplying four or more points can overwrite the stack frame through a stack-based buffer overflow. This can crash the process or permit code execution.

Published Nov 2, 2026

Updated

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.

Affected Software

9 affected components

debian/pymupdf*

debian/pymupdf<=1.21.1+ds1-1, <=1.25.4+ds1-3+deb13u1, <=1.28.2+ds1-1

ubuntu/pymupdf*

Event History

Nov 2, 2026

CVE Published

via OSV·10:16 PM

Data Sourced

via OSV·10:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·11:17 PM

Affected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using affected PyMuPDF versions are exposed if an attacker can control the callout argument supplied to Page.add_freetext_annot(). The listed affected software includes PyMuPDF packages for Ubuntu and Debian.

What does exploitation require?

The attacker needs the ability to provide four or more callout points to Page.add_freetext_annot(). No user interaction is required, but the attacker must have the privileges needed to influence that application input.

What is the impact of a successful exploit?

Supplying four or more points can overwrite the stack frame through a stack-based buffer overflow. This can crash the process or permit code execution.

CVE-2026-120752: PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?

What is the impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?

What is the impact of a successful exploit?