UBUNTU-CVE-2026-120752: Buffer Overflow
PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PyMuPDFto a version that resolves this vulnerability.Fixed in 2.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using the Ubuntu PyMuPDF package are exposed if they call Page.add_freetext_annot() with a callout argument influenced or controlled by an untrusted party. The vulnerable behavior is in processing that caller-supplied callout data.
What does an attacker need to exploit it?
An attacker needs to control the callout argument passed to Page.add_freetext_annot(). Supplying four or more callout points can overflow a fixed three-element stack array.
What could exploitation cause?
The overflow can crash the affected process or enable code execution by overwriting the stack frame. The reported impact includes confidentiality, integrity, and availability.
How can I determine whether my application is at risk?
Review uses of Page.add_freetext_annot() and determine whether the callout argument can contain untrusted input. Calls that permit four or more supplied callout points meet the described overflow condition.