Remote Code Execution (RCE)

🗓️ 13 Dec 2025 07:49:21Reported by Veracode Vulnerability DatabaseType

Pdfminer six is vulnerable to remote code execution via unsafe deserialization in CMapDB when loading pickle files from PDFs.

Reporter	Title	Published	Views	Family All 66
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	22 Jul 202618:17	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	21 Jul 202623:46	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	21 Jul 202609:56	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	19 Jul 202610:49	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	27 Jul 202619:30	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six	27 Jul 202619:30	–	githubexploit
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	2 Feb 202613:08	–	ibm
ATTACKERKB	CVE-2025-70559	3 Feb 202600:00	–	attackerkb
Circl	CVE-2025-64512	7 Nov 202519:53	–	circl

Vulners

Node

pdfminer_six pdfminer_sixRange20160614–20250506python

pdfminer_six pdfminer_sixRange20140915–20250506python

Source	Link
github	www.github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086
lists	www.lists.debian.org/debian-lts-announce/2026/01/msg00005.html
lists	www.lists.debian.org/debian-lts-announce/2025/11/msg00017.html
github	www.github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp
github	www.github.com/pdfminer/pdfminer.six/releases/tag/20251107

01 Aug 2026 18:45Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.8 - 8.6

EPSS0.00314

SSVC