GHSA-M8GF-V64P-GFMG BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then...

PT-2026-5984

Name of the Vulnerable Software and Affected Versions pdfminer.six versions prior to 20251230 Description pdfminer.six contains an insecure deserialization issue in the CMap loading mechanism. The library utilizes Python pickle to deserialize CMap cache files without proper validation. An attacke...