p PatchFirst

CVE-2025-64512

CVE-2025-64512 · pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.

CVSS 8.6 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pdfminer.six

    Versions
    • < 20251107: Affected

    No fix published

  • pdfminer Debian:12

    Versions
    • 20221105+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 20221105+dfsg-1.1~deb12u1

    Update to 20221105+dfsg-1.1~deb12u1

  • pdfminer Debian:13

    Versions
    • 20221105+dfsg-1
    • 20221105+dfsg-1.1~deb12u1
    Affected ranges
    • ECOSYSTEM: < 20221105+dfsg-1.1~deb13u1

    Update to 20221105+dfsg-1.1~deb13u1

  • pdfminer Debian:14

    Versions
    • 20221105+dfsg-1
    • 20221105+dfsg-1.1~deb12u1
    • 20221105+dfsg-1.1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 20221105+dfsg-1.1

    Update to 20221105+dfsg-1.1

  • pdfminer-six PyPI

    Versions
    • 20140915
    • 20151013
    • 20160202
    • 20160614
    • 20170418
    • 20170419
    • 20170720
    • 20181108
    • 20191020
    • 20191107
    • 20191110
    • 20200104
    • 20200121
    • 20200124
    • 20200401
    • 20200402
    • 20200517
    • 20200720
    • 20200726
    • 20201018
    • 20211012
    • 20220319
    • 20220506
    • 20220524
    • 20221105
    • 20231228
    • 20240706
    • 20250324
    • 20250327
    • 20250416
    • 20250506
    Affected ranges
    • ECOSYSTEM: < 20251107

    Update to 20251107

  • pdfminer Ubuntu:Pro:16.04:LTS

    Versions
    • 20110515+dfsg-1
    • 20140328+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 20140328+dfsg-1ubuntu0.16.04.1~esm1

    Update to 20140328+dfsg-1ubuntu0.16.04.1~esm1

  • pdfminer Ubuntu:Pro:18.04:LTS

    Versions
    • 20140328+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 20140328+dfsg-1ubuntu0.18.04.1~esm1

    Update to 20140328+dfsg-1ubuntu0.18.04.1~esm1

  • pdfminer Ubuntu:Pro:20.04:LTS

    Versions
    • 20181108+dfsg-3
    • 20191020+dfsg-1
    • 20191020+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 20191020+dfsg-2ubuntu0.1~esm1

    Update to 20191020+dfsg-2ubuntu0.1~esm1

  • pdfminer Ubuntu:Pro:22.04:LTS

    Versions
    • 20200726-1
    • 20201018+dfsg-1
    • 20220319+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 20220319+dfsg-1ubuntu0.1~esm1

    Update to 20220319+dfsg-1ubuntu0.1~esm1

  • pdfminer Ubuntu:Pro:24.04:LTS

    Versions
    • 20221105+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 20221105+dfsg-1ubuntu0.1~esm1

    Update to 20221105+dfsg-1ubuntu0.1~esm1

  • pdfminer Ubuntu:25.10

    Versions
    • 20221105+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →