PyMuPDF CVE-2026-120752

Exploitation requires the vulnerable code path to be reached through Page.add_freetext_annot() with an attacker-controllable 'callout' argument supplying four or more points, which overflows the three-element stack array in JM_set_annot_callout_line(). The key limiting factor is that the application must route untrusted input into this specific callout parameter - most applications either do not create callout free-text annotations or hardcode their points, so the attack surface is not exposed by default. Affected only in PyMuPDF versions 1.25.3 up to (but not including) 2.0; updating to 2.0 (which adds the count>3 bounds check) removes the condition.

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.7, HIGH) reflects a memory-corruption flaw with full confidentiality/integrity/availability impact to the vulnerable system, but two signals temper it: AT:P (a specific attack requirement must hold) and PR:L (some privilege/application access is required), meaning this is not a trivially reachable network bug. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; the vuln.today Decision label is 'this_week', i.e. prompt but not emergency. A public PoC reference exists (issue #5112 and the vendor's own regression test test_5112, which triggers the overflow with 100 callout points); it is not verified as a working code-execution exploit, and it demonstrates a crash rather than confirmed RCE. The most important caveat is reachability: the AV:N in the input is debatable because exploitation requires an application to pass an attacker-controlled 'callout' argument into Page.add_freetext_annot() - this is a library API misuse surface, not a network-exposed PDF parser, so in practice the attacker must already be able to influence that specific Python argument. Net: a genuine stack buffer overflow worth patching this week, but real-world exposure is gated on an uncommon data flow rather than being broadly remotely reachable, so for most deployments this is lower real risk than the 7.7 suggests.

An application uses PyMuPDF to build free-text annotations and lets untrusted input flow into the 'callout' argument of Page.add_freetext_annot(). The attacker supplies four or more callout points, overflowing the fixed three-element stack array in JM_set_annot_callout_line() and corrupting the stack frame, crashing the worker process or potentially achieving code execution. A public reproducer (test_5112 / issue #5112) demonstrates the crash using 100 points.