PyMuPDF callout stack buffer overflow allows crash or code execution

Summary

PyMuPDF 1.25.3 before 2.0 has a stack buffer overflow in the annotation callout code. If an attacker controls the callout argument, they can crash the process or execute code.

Affected when

• Attacker controls the callout argument of add_freetext_annot()

What to do

Update to PyMuPDF 2.0. The command is python -m pip install --upgrade pymupdf.

Add this line to the config file:

python -m pip install --upgrade pymupdf

A wrong setting can stop the service or lock you out. Check the source links below first.

Products and platforms

• Windows
• macOS
• Linux
• PyMuPDF

CVE IDs

• CVE-2026-120752 (opens in a new tab)

Sources

• Advisory: github.com (opens in a new tab)
• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab) · github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-02 22:16 UTC

First seen 2026-11-09 14:10 UTC