Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: PyMuPDF Clear all filters
TI-2026-84125 CVE-2026-120752 · GHSA-x2mr-6hpr-g257

Stack buffer overflow in PyMuPDF add_freetext_annot() callout

Priority HIGH 69

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00373 Published 2026-11-02 Partial fix · 2.0 CWE-121
TI-2026-56614 CVE-2026-82035 · GHSA-434w-92hw-f2m3

PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch

Priority LOW 31

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controll…

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00316 Published 2026-09-14 Partial fix CWE-22