Threats tagged 'ghsa-x2mr-6hpr-g257'

PyMuPDF versions before 2.0, including 1.25.3, have a stack-based buffer overflow vulnerability in the JM_set_annot_callout_line() function. This flaw occurs because the function copies a caller-supplied number of callout points into a fixed-size three-element stack array without proper bounds checking. An attacker controlling the callout argument passed to Page.add_freetext_annot() can supply four or more points, potentially overwriting the stack frame, leading to process crashes or arbitrary code execution.