CyberSecBulletin

PyMuPDF vulnerabilities

We track 2 vulnerabilities in PyMuPDF products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.

2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score

Latest PyMuPDF vulnerabilities

  • 7.5 High severity

    PyMuPDF: Stack-based Buffer Overflow

    CVE-2026-120752PyMuPDF

    PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Pa

  • 7.1 High severity

    PyMuPDF: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2026-82035PyMuPDF

    PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-