DEBIAN-CVE-2026-120752: Buffer Overflow
PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PyMuPDFto a version that resolves this vulnerability.Fixed in 2.0
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs to control the callout argument supplied to Page.add_freetext_annot() and provide four or more callout points. Exploitation also requires low-privileged access, but no user interaction.
Which applications are realistically exposed?
Applications using PyMuPDF that accept untrusted input and pass attacker-controlled callout-point data to Page.add_freetext_annot() are exposed. Applications that do not use this API with externally controlled callout data are not described as affected.
What is the impact if exploitation succeeds?
Supplying too many points can overwrite the stack frame. This can crash the affected process or potentially allow code execution, with high confidentiality, integrity, and availability impact.
What can be done if an update cannot be applied immediately?
Ensure that callers of Page.add_freetext_annot() reject callout inputs containing more than three points before invoking the API. Do not pass untrusted callout arrays through without validating their length.