PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout

Summary

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.

Remediation

1. Inventory every PyMuPDF PyMuPDF deployment, including staging.
2. Upgrade PyMuPDF PyMuPDF to 2.0.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae1c9065c81cd9a275a1b092f5e
• Advisoryhttps://www.vulncheck.com/advisories/pymupdf-1.25.3-before-2.0-stack-buffer-overflow-via-add-freetext-annot-callout
• Referencehttps://github.com/pymupdf/PyMuPDF/issues/5112
• Referencehttps://github.com/pymupdf/PyMuPDF/issues/5173
• Referencehttps://github.com/pymupdf/PyMuPDF/blob/1.28.2/src/extra.i#L787-L797
• Referencehttps://github.com/pymupdf/PyMuPDF/releases/tag/2.0
• Referencehttps://github.com/pymupdf/PyMuPDF