Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : pdfminer vulnerabilities (USN-8837-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8837-1 advisory. It was discovered that pdfminer did not safely parse specially crafted PDF files. An attacker could possibly use thes...

USN-8837-1 pdfminer vulnerabilities

It was discovered that pdfminer did not safely parse specially crafted PDF files. An attacker could possibly use these issues to execute arbitrary code. CVE-2025-64512, CVE-2025-70559...

USN-8837-1: pdfminer vulnerabilities

It was discovered that pdfminer did not safely parse specially crafted PDF files. An attacker could possibly use these issues to execute arbitrary code. CVE-2025-64512, CVE-2025-70559...

CVE-2026-54071

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

CVE-2026-54071: Deserialization of Untrusted Data

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six

CVE-2025-64512 - pdfminer.six Remote Code Execution RCE !...

Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six

No d...

Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six

CVE-2025-64...

Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six

CVE-2025-64512 - pdfminer.six Remote Code Execution RCE !...

Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six

CVE-2025-64512 — pdfminer.six Insecure Deserialization Pickle...

Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six

No d...

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py SummaryBabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then...

PYSEC-2026-1761 Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

🚀 Overview This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading. It shows how a low-privileged user can gain root access or escalate to any service account by exploiting insecure deserializatio...

PYSEC-2026-1762 Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

Summary pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB.loaddata function in pdfminer.six uses pickle.loads to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in th...

Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

Summarypdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB.loaddata function in pdfminer.six uses pickle.loads to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses pdfminersix-20251107-py3-none-any.whl, requests-2.32.5-py3-none-any.whl, langchaincore-0.3.81-py3-none-any.whl, pythondotenv-1.0.1-py3-none-any.whl, langchaintextsplitters-0.3.11-py3-none-any.whl, qs-6.15.1.tgz, idna-3.10-py3-none-any.whl, idna-3.14-py3-none-any.whl...

ROOT-APP-PYPI-CVE-2025-64512 CVE-2025-64512 in rootio-pdfminer.six - Patched by Root

Root has patched CVE-2025-64512 in the rootio-pdfminer.six package for Root:PyPI. Multiple fixed versions available...

CVE-2025-70559

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the applicati...

UBUNTU-CVE-2025-70559

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the applicati...

CVE-2025-70559

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the applicati...