Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-64512
Good to know:
Date: November 10, 2025
Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The "CMapDB._load_data()" function in pdfminer.six uses "pickle.loads()" to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the "cmap/" directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in ".pickle.gz". A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.
Severity Score
Related Resources (6)
Severity Score
Weakness Type (CWE)
Deserialization of Untrusted Data
CWE-502Top Fix
Upgrade Version
Upgrade to version pdfminer.six - 20251107;pdfminer.six - 20251107;pdfminer-six - 20251107;https://github.com/pdfminer/pdfminer.six.git - 20251107
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | LOCAL |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | REQUIRED |
| Scope (S): | CHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |