PyMuPDF: Stack-based buffer overflow in JM_set_annot_callout_line (CVE-2026-120752)

PyMuPDF versions before 2.0 contain a stack-based buffer overflow vulnerability in the function JM_set_annot_callout_line. The function fails to validate the number of callout points supplied by the caller, copying them into a fixed three-element stack array. An attacker controlling the callout argument passed to the Page.add_freetext_annot method can provide four or more points to overwrite the stack frame. Successful exploitation may result in a crash of the host process or arbitrary code execution.

Impact

Successful exploitation allows for memory corruption within the application process, leading to denial of service via process crash or potential arbitrary code execution under the context of the user or service running the PyMuPDF library.

Recommendation

Upgrade all instances of PyMuPDF to version 2.0 or later immediately to incorporate the bounds checking fix for the JM_set_annot_callout_line function. Perform an inventory of internal applications and third-party software that utilize the PyMuPDF library to identify instances requiring updates.