github.com

Critical RCE Vulnerability in PyMuPDF Affects All Released Versions

First seen 3 Nov 2026, 07:13 UTC •66.6

Article Content

1 / 3

Browse articles

ThreatCluster •November 3, 2026 at 18:16 UTC

•All released versions of PyMuPDF are vulnerable to RCE due to an out-of-bounds stack write.
•The vulnerability can be exploited by passing more than three points in annotations.
•A fix is in development but has not yet been released, leaving systems exposed.

A critical out-of-bounds stack write vulnerability in PyMuPDF's JM_set_annot_callout_line function allows for arbitrary code execution. All released versions, including the latest 1.28.2, are affected due to a lack of bounds validation when handling callout points. This vulnerability can be exploited by passing more than three points to the Page.add_freetext_annot method, leading to potential control over the saved return address. The issue has been documented in GitHub issues 5112 and 5173, with proof-of-concept code available. A fix has been developed but not yet released, leaving systems vulnerable. Users are advised to monitor for updates and apply patches as soon as they are available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-07

Fix development announced

Developer julian-smith-artifex-com announced a fix for the vulnerability, with a release schedule to be determined.

Article 2

2026-09-08

Additional commit for vulnerability fix

A commit referencing the vulnerability was added, indicating ongoing efforts to address the issue.

Article 2

2026-11-03

Vulnerability disclosed

The out-of-bounds stack write vulnerability was publicly disclosed, affecting all released versions of PyMuPDF.

Article 1

Threat Graph

4 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Weakness (1)

CWE-787 - Out-of-bounds Write

Affected Platform (1)

Readelf

Tool (1)

Relationships

Zero-day Exploit targets Readelf
Gdb related to CWE-787 - Out-of-bounds Write

Common questions

Which versions of PyMuPDF are affected?

All released versions of PyMuPDF, including the latest version 1.28.2, are affected.

Is there a patch available?

A fix is in development but has not yet been released, so no patch is currently available.

How can this vulnerability be exploited?

An attacker can exploit this vulnerability by passing more than three points to the Page.add_freetext_annot method, leading to arbitrary code execution.