Read the docs
TI-2026-84125 Aliases CVE-2026-120752GHSA-x2mr-6hpr-g257

Stack buffer overflow in PyMuPDF add_freetext_annot() callout

Priority HIGH 69CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-121 and the CVSS impact.

Summary

PyMuPDF from 1.25.3 before 2.0 contains a stack-based buffer overflow in its callout line handling. The code copies a caller-supplied number of callout points into a fixed three-element stack array, so excess points overwrite the stack frame (CWE-121). A remote attacker with low privileges who controls the callout argument of Page.add_freetext_annot() can crash the process or execute code.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00373 31st percentileScored 2026-11-07
Fix Partial PyMuPDF (PyMuPDF): 2.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PyMuPDFPyMuPDF1.25.3 to before 2.02.0Patch availableCNA
  • PyMuPDF VendorPyMuPDF Affected 1.25.3 to before 2.0 Fixed in 2.0 Patch available CNA

Remediation

Upgrade PyMuPDF to version 2.0, which fixes the flaw. Red Hat rates it Important and lists Red Hat Enterprise Linux AI (RHEL AI) 3 as affected with no available plan. The sources list no fixed version for Red Hat Enterprise Linux AI (RHEL AI) 3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA PyMuPDF (PyMuPDF) Fixed in 2.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120752
  2. 2026-11-03 Affected versions changed · Red Hat
  3. 2026-11-03 CVSS score added · Red Hat
  4. 2026-11-03 Alias added: GHSA-x2mr-6hpr-g257
  5. 2026-11-04 Priority changed: MEDIUM → LOW
  6. 2026-11-07 CISA SSVC decision points changed
  7. 2026-11-07 Priority changed: LOW → HIGH

References

Patch 1

Other 5

  • TI-2026-56614 PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences