CVE-2025-64512
published 2025-11-10CVE-2025-64512: Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107…
PriorityP344high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.31%
23.8th percentile
Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | pdfminer | < pdfminer 20221105+dfsg-1.1~deb12u1 (bookworm) | pdfminer 20221105+dfsg-1.1~deb12u1 (bookworm) |
| debian | pdfminer | < pdfminer 20200726-1+deb11u2 (bullseye) | pdfminer 20200726-1+deb11u2 (bullseye) |
| pdfminer | pdfminer.six | < 2025-11-07 | 2025-11-07 |
| pdfminer | pdfminer.six | >= 0 < 20251107 | 20251107 |
| pdfminer | pdfminer.six | >= 0 < 20251230 | 20251230 |
| python | pillow | >= 5.1.0 < 12.3.0 | 12.3.0 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ghsa7.8HIGH
osv7.8HIGH
vendor_debian8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
ghsa·2026-07-20
CVE-2026-59200 [HIGH] CWE-400 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
### Summary
`PdfParser.PdfStream.decode()` in Pillow's `PdfParser.py` calls `zlib.decompress()` with the `bufsize` parameter set to the value of the PDF stream's `Length` field, without any upper bound on the actual decompressed output size. Python's `zlib.decompress()` `bufsize` argument is an *initial output buffer hint*, not a maximum size limit — the function will expand memory until the full decompressed result is produced. A crafted PDF containing a FlateDecode-compressed stream decompresses to 1 GB of memory from a ~950 KB file, causing server OOM termination or severe degradation in any application that uses `PdfParser` to read untrusted PDF files.
### Details
`PdfStream.decode()` in `pdfminer/PdfParser.py` reads the
OSV
Duplicate Advisory: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
osv·2026-02-03·CVSS 7.8
[HIGH] Duplicate Advisory: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
Duplicate Advisory: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f83h-ghpp-7wcc. This link is maintained to preserve external references.
## Original Description
pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.
GHSA
Duplicate Advisory: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
ghsa·2026-02-03·CVSS 7.8
[HIGH] CWE-502 Duplicate Advisory: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
Duplicate Advisory: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f83h-ghpp-7wcc. This link is maintained to preserve external references.
## Original Description
pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.
OSV
CVE-2025-70559: pdfminer
osv·2026-02-03·CVSS 7.8
CVE-2025-70559 [HIGH] CVE-2025-70559: pdfminer
pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.
OSV
CVE-2025-64512: Pdfminer
osv·2025-11-10·CVSS 7.8
CVE-2025-64512 [HIGH] CVE-2025-64512: Pdfminer
Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.
GHSA
Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
ghsa·2025-11-07·CVSS 7.8
CVE-2025-70559 [HIGH] CWE-502 Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
### 🚀 Overview
This report **demonstrates a real-world privilege escalation** vulnerability in [pdfminer.six](https://github.com/pdfminer/pdfminer.six) due to unsafe usage of Python's `pickle` module for CMap file loading.
It shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.
## 🚨 Special Note
This advisory addresses a distinct vulnerability from [GHSA-wf5f-4jwr-ppcp (CVE-2025-64512)](https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp).
While the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit [b808
GHSA
Arbitrary Code Execution in pdfminer.six via Crafted PDF Input
ghsa·2025-11-07
CVE-2025-64512 [HIGH] CWE-502 Arbitrary Code Execution in pdfminer.six via Crafted PDF Input
Arbitrary Code Execution in pdfminer.six via Crafted PDF Input
### Summary
pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed.
### Details
```python
# Vulnerable code in pdfminer/cmapdb.py:233-246
def _load_data(cls, name: str) -> Any:
name = name.replace("\0", "") # Insufficient sanitization
file
OSV
Arbitrary Code Execution in pdfminer.six via Crafted PDF Input
osv·2025-11-07
CVE-2025-64512 [HIGH] Arbitrary Code Execution in pdfminer.six via Crafted PDF Input
Arbitrary Code Execution in pdfminer.six via Crafted PDF Input
### Summary
pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed.
### Details
```python
# Vulnerable code in pdfminer/cmapdb.py:233-246
def _load_data(cls, name: str) -> Any:
name = name.replace("\0", "") # Insufficient sanitization
file
OSV
Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
osv·2025-11-07·CVSS 7.8
CVE-2025-70559 [HIGH] Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
### 🚀 Overview
This report **demonstrates a real-world privilege escalation** vulnerability in [pdfminer.six](https://github.com/pdfminer/pdfminer.six) due to unsafe usage of Python's `pickle` module for CMap file loading.
It shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.
## 🚨 Special Note
This advisory addresses a distinct vulnerability from [GHSA-wf5f-4jwr-ppcp (CVE-2025-64512)](https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp).
While the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit [b808
Debian
CVE-2025-64512: pdfminer - Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for...
vendor_debian·2025·CVSS 8.6
CVE-2025-64512 [HIGH] CVE-2025-64512: pdfminer - Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for...
Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.
Scope: local
bookworm: resolved (fixed in 20221105+dfsg-1.1~deb12
Debian
CVE-2025-70559: pdfminer - pdfminer.six before 20251230 contains an insecure deserialization vulnerability ...
vendor_debian·2025·CVSS 8.6
CVE-2025-70559 [HIGH] CVE-2025-70559: pdfminer - pdfminer.six before 20251230 contains an insecure deserialization vulnerability ...
pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.
Scope: local
bookworm: open
bullseye: resolved (fixed in 20200726-1+deb11u2)
forky: resolved (fixed in 20260107+dfsg-1)
sid: resolved (fixed in 20260107+dfsg-1)
trixie: open
No detection rules found.
No public exploits indexed.
https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086https://github.com/pdfminer/pdfminer.six/releases/tag/20251107https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcphttps://lists.debian.org/debian-lts-announce/2025/11/msg00017.htmlhttps://lists.debian.org/debian-lts-announce/2026/01/msg00005.htmlhttps://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp
2025-11-10
Published