{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/pymupdf/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pymupdf:pymupdf:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-120752"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PyMuPDF (\u003c 2.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","code-execution","buffer-overflow"],"_cs_type":"advisory","_cs_vendors":["PyMuPDF"],"content_html":"\u003cp\u003ePyMuPDF versions before 2.0 contain a stack-based buffer overflow vulnerability in the function JM_set_annot_callout_line. The function fails to validate the number of callout points supplied by the caller, copying them into a fixed three-element stack array. An attacker controlling the callout argument passed to the Page.add_freetext_annot method can provide four or more points to overwrite the stack frame. Successful exploitation may result in a crash of the host process or arbitrary code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for memory corruption within the application process, leading to denial of service via process crash or potential arbitrary code execution under the context of the user or service running the PyMuPDF library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade all instances of PyMuPDF to version 2.0 or later immediately to incorporate the bounds checking fix for the JM_set_annot_callout_line function. Perform an inventory of internal applications and third-party software that utilize the PyMuPDF library to identify instances requiring updates.\u003c/p\u003e\n","date_modified":"2026-11-02T23:48:11Z","date_published":"2026-11-02T23:48:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pymupdf-buffer-overflow/","summary":"PyMuPDF versions prior to 2.0 contain a stack-based buffer overflow in the JM_set_annot_callout_line function, allowing remote code execution via specifically crafted callout arguments in Page.add_freetext_annot.","title":"PyMuPDF: Stack-based buffer overflow in JM_set_annot_callout_line (CVE-2026-120752)","url":"https://feed.craftedsignal.io/briefs/2026-11-pymupdf-buffer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - PyMuPDF","version":"https://jsonfeed.org/version/1.1"}