Buffer overflow in Pymupdf
CVE-2026-120752
PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.
Vulnerability class: Buffer Overflow
Published .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/pymupdf/PyMuPDF/issues/5112 (issue-tracking)
- github.com/pymupdf/PyMuPDF/issues/5173 (issue-tracking, technical-description)
- github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae1c9065c81cd9a275a1b092f5e (patch)
- github.com/pymupdf/PyMuPDF/blob/1.28.2/src/extra.i (technical-description)
- github.com/pymupdf/PyMuPDF/releases/tag/2.0 (release-notes)
- github.com/pymupdf/PyMuPDF (product)
- www.vulncheck.com/advisories/pymupdf-1.25.3-before-2.0-stack-buffer-overflow-vi… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-120752?
- CVE-2026-120752 is a high-severity vulnerability in Pymupdf, classified under Stack-based Buffer Overflow. CVSS score: 7.5/10. Published 2026-11-02.
- How severe is CVE-2026-120752?
- High severity. CVSS v3 base score is 7.5 out of 10.