PyMuPDF
Monthly
A stack-based buffer overflow in PyMuPDF's JM_set_annot_callout_line() lets code that controls the 'callout' argument of Page.add_freetext_annot() pass four or more points into a fixed three-element stack array, corrupting the stack frame and potentially crashing the interpreter or achieving code execution in the process that imports the library. The flaw is present in PyMuPDF 1.25.3 up to but not including 2.0, and is fixed in the 2.0 release by an added count>3 bounds check that raises a 'bad seq of points' RuntimeError. The supplied CVSS 4.0 vector scores it 7.7, while the independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that low privileges and a specific precondition (the hosting application must route untrusted data into the callout parameter) are required; there is no CISA KEV entry and no public exploit identified at time of analysis, though the upstream fix commit ships a regression test that reproduces the overflow with a 100-point callout.
Path traversal in PyMuPDF's object-extraction CLI lets a crafted PDF, EPUB, XPS, or FB2 file write arbitrary files outside the user-selected output directory. The extract_objects() font branch joins an attacker-controlled BaseFont name onto the output path without stripping '../' or absolute-path sequences (CWE-22), yielding a CVSS 4.0 base score of 7.1 with high integrity impact but no confidentiality loss. A fix is available upstream in commit b2c8f3a; no public exploit code or CISA KEV activity is known at time of analysis.
PyMuPDF versions up to 1.26.5 allow unauthenticated remote attackers to write arbitrary files to the system through path traversal in the embedded get function. This vulnerability enables denial of service attacks and potential system compromise without requiring authentication or user interaction. No patch is currently available.
A stack-based buffer overflow in PyMuPDF's JM_set_annot_callout_line() lets code that controls the 'callout' argument of Page.add_freetext_annot() pass four or more points into a fixed three-element stack array, corrupting the stack frame and potentially crashing the interpreter or achieving code execution in the process that imports the library. The flaw is present in PyMuPDF 1.25.3 up to but not including 2.0, and is fixed in the 2.0 release by an added count>3 bounds check that raises a 'bad seq of points' RuntimeError. The supplied CVSS 4.0 vector scores it 7.7, while the independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that low privileges and a specific precondition (the hosting application must route untrusted data into the callout parameter) are required; there is no CISA KEV entry and no public exploit identified at time of analysis, though the upstream fix commit ships a regression test that reproduces the overflow with a 100-point callout.
Path traversal in PyMuPDF's object-extraction CLI lets a crafted PDF, EPUB, XPS, or FB2 file write arbitrary files outside the user-selected output directory. The extract_objects() font branch joins an attacker-controlled BaseFont name onto the output path without stripping '../' or absolute-path sequences (CWE-22), yielding a CVSS 4.0 base score of 7.1 with high integrity impact but no confidentiality loss. A fix is available upstream in commit b2c8f3a; no public exploit code or CISA KEV activity is known at time of analysis.
PyMuPDF versions up to 1.26.5 allow unauthenticated remote attackers to write arbitrary files to the system through path traversal in the embedded get function. This vulnerability enables denial of service attacks and potential system compromise without requiring authentication or user interaction. No patch is currently available.