A stack-based buffer overflow exists in the PyMuPDF library within the JM_set_annot_callout_line() function. The vulnerability is triggered when an attacker supplies four or more callout points to the Page.add_freetext_annot() API. The copy operation writes the extra points into a fixed three-element array, corrupting adjacent stack data. As a result, an attacker can crash the process or potentially execute arbitrary code if the overflow is exploited successfully.

All PyMuPDF releases before version 2.0, including the 1.25.3 line, are affected. The vendor is PyMuPDF.

The vulnerability carries a CVSS score of 7.7, indicating high severity. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker control the callout argument to Page.add_freetext_annot(); this typically occurs in environments where the library is used to process untrusted input. If the attacker can supply a malicious callout, the overflow could cause a denial of service or remote code execution in the process executing the library.