PyMuPDF (< 2.0)

PyMuPDF versions prior to 2.0 contain a stack-based buffer overflow in the JM_set_annot_callout_line function, allowing remote code execution via specifically crafted callout arguments in Page.add_freetext_annot.