{"id":"DEBIAN-CVE-2026-120752","details":"PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.","modified":"2026-11-04T09:47:27.967156Z","published":"2026-11-02T23:17:20.243Z","upstream":["CVE-2026-120752"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-120752"}],"affected":[{"package":{"name":"pymupdf","ecosystem":"Debian:12","purl":"pkg:deb/debian/pymupdf?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1+ds1-1","1.22.5+ds1-1","1.23.7+ds1-1","1.24.2+ds1-1","1.24.2+ds1-2","1.24.2+ds1-3","1.25.0+ds1-1","1.25.0+ds1-2","1.25.4+ds1-1","1.25.4+ds1-2","1.25.4+ds1-3","1.25.4+ds1-4","1.26.7+ds1-1","1.28.2+ds1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120752.json"}},{"package":{"name":"pymupdf","ecosystem":"Debian:13","purl":"pkg:deb/debian/pymupdf?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.4+ds1-3","1.25.4+ds1-3+deb13u1","1.25.4+ds1-4","1.26.7+ds1-1","1.28.2+ds1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120752.json"}},{"package":{"name":"pymupdf","ecosystem":"Debian:14","purl":"pkg:deb/debian/pymupdf?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.4+ds1-3","1.25.4+ds1-4","1.26.7+ds1-1","1.28.2+ds1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120752.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}