CVE-2026-54071 BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

SUSE CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

Linux Distros Unpatched Vulnerability : CVE-2026-20346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded...

DEBIAN-CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

AZL-95450 CVE-2026-20346 affecting package clamav for versions less than 1.5.4-1

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

UBUNTU-CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

PT-2026-69074

Name of the Vulnerable Software and Affected Versions ClamAV affected versions not specified Description A flaw in the PDF file format parser allows an unauthenticated remote attacker to cause a Denial of Service DoS or other impacts via memory corruption. The issue stems from improper boundary...

clamav -- Multiple vulnerabilities

The ClamAV project reports: CVE-2026-20345: indexing error while converting GPT partition names could read or write beyond a stack-allocated partition entry. CVE-2026-20339: integer overflow in the PESpin unpacker could allocate an undersized buffer and write beyond it. CVE-2026-20346: integer...

CVE-2026-54081

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java,...

Pillow PDF Stream DoS

The vulnerability of the PdfParser.PdfStream.decode function in the PIL/PdfParser.py module of the Pillow image processing library is related to uncontrolled memory allocation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

UBUNTU-CVE-2026-59200

Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode in PIL/PdfParser.py calls zlib.decompress with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small...

CVE-2026-59200 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode in PIL/PdfParser.py calls zlib.decompress with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small...

deckz (2.6.0), ocrmypdf (>=9.7.2, <=9.8.0) +4 more potentially affected by CVE-2025-64512 via pdfminer-six (20200402.0.0)

pdfminer-six PYPI version 20200402.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - deckz 2.6.0 - ocrmypdf =9.7.2, =0.1.0, =1.0.0, =1.36.10, =1.38.1 Source cves: CVE-2025-64512 Source advisory: OSV:PYSEC-2026-1762...

bankruptcy (>=0.0.2, <=0.0.5), copy-spotter (>=0.1.12, <=0.1.16) +7 more potentially affected by CVE-2025-64512 via pdfminer-six (20200517.0.0)

pdfminer-six PYPI version 20200517.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - bankruptcy =0.0.2, =0.1.12, =1.1.1, =0.1.0a1, =9.8.1, =0.4.0, =1.38.2, =1.42.15 Source cves: CVE-2025-64512 Source advisory:...

deckz (2.6.0), ocrmypdf (>=9.7.2, <=9.8.0) +4 more potentially affected by CVE-2025-70559 via pdfminer-six (20200402.0.0)

pdfminer-six PYPI version 20200402.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - deckz 2.6.0 - ocrmypdf =9.7.2, =0.1.0, =1.0.0, =1.36.10, =1.38.1 Source cves: CVE-2025-70559 Source advisory: OSV:PYSEC-2026-1761...

PT-2026-55311

Name of the Vulnerable Software and Affected Versions pdfcpu versions prior to 0.11.2 Description A denial-of-service issue exists where the parser descends recursively through nested PDF objects, including arrays, without enforcing a maximum nesting depth. This occurs within the ParseObjectConte...