CVE-2026-120752

Name	CVE-2026-120752
Description	PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pymupdf (PTS)	bookworm	1.21.1+ds1-1	vulnerable
	trixie	1.25.4+ds1-3+deb13u1	vulnerable
	forky, sid	1.28.2+ds1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pymupdf	source	(unstable)	(unfixed)

Notes

https://github.com/pymupdf/PyMuPDF/issues/5112
https://github.com/pymupdf/PyMuPDF/issues/5173
Fixed by: https://github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae1c9065c81cd9a275a1b092f5e (2.0)