Threats affecting pkg:pypi/PyMuPDF

PyMuPDF versions from 1.25.3 up to but not including 2.0 contain a stack-based buffer overflow vulnerability in the JM_set_annot_callout_line() function. This flaw arises when the function copies a caller-supplied number of callout points into a fixed-size three-element stack array without proper bounds checking. An attacker controlling the callout argument passed to Page.add_freetext_annot() can supply four or more points, leading to stack frame overwrite, which may cause a crash or enable code execution. The vulnerability is rated high severity with a CVSS score of 7.7. It is fixed in PyMuPDF version 2.0.

PyMuPDF versions through 1.28.2 contain a path traversal vulnerability in the font branch of the extract_objects() function. This flaw allows an attacker to craft malicious document files with specially encoded BaseFont names that decode to directory traversal sequences or absolute paths, enabling arbitrary file writes outside the intended output directory without authentication or elevated privileges. The vulnerability was fixed in a commit identified as b2c8f3a.

A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.