CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM set annot callout line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add freetext annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.