Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six

🗓️ 15 Sep 2026 05:39:37Reported by Jinook-KimType

githubexploit🔗 github.com👁 5 Views

RCE in pdfminer.six via deserialization of attacker-controlled pickle through CMap name.

Reporter	Title	Published	Views	Family All 76
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	22 Jul 202618:17	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	21 Jul 202623:46	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	15 Aug 202616:57	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	12 Aug 202606:32	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	21 Jul 202609:56	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	19 Jul 202610:49	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	27 Jul 202619:30	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	27 Jul 202619:30	–	githubexploit
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	2 Feb 202613:08	–	ibm

15 Sep 2026 05:41Current

CVSS 3.17.8 - 8.6

EPSS0.00312

SSVC

pdfminer.six Deserialization pickle.loads RCE CMap loading absolute path