Deserialization of Untrusted Data in pdfminer.six - CVE-2025-64512

Vulnerability identifier: #VU118799

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-64512

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in CMapDB._load_data(). A remote attacker can trick the victim into opening a specially crafted PDF file and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

pdfminer.six
Debian Linux
Fedora
Ubuntu
openEuler
pdfminer (Ubuntu package)
python-pdfminer
pdfminer (Debian package)
python-pdfminer.six
python-pdfminer.six-help
python3-pdfminer.six

Install updates from vendor's website.

pdfminer.six - update to 20251107
pdfminer (Ubuntu package) - addressed in versions 20140328+dfsg-1ubuntu0.16.04.1~esm1, 20140328+dfsg-1ubuntu0.18.04.1~esm1, 20191020+dfsg-2ubuntu0.1~esm1, 20220319+dfsg-1ubuntu0.1~esm1, 20221105+dfsg-1ubuntu0.1~esm1
python-pdfminer - update to 20220319-3.el8
pdfminer (Debian package) - addressed in versions 20221105+dfsg-1.1~deb12u1, 20221105+dfsg-1.1~deb13u1
python-pdfminer.six - update to 20231228-4
python-pdfminer.six-help - update to 20231228-4
python3-pdfminer.six - update to 20231228-4

• Exploit #12279 - CVE-2025-64512-Polyglot-PoC (January 9, 2026)

• https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086
• https://github.com/pdfminer/pdfminer.six/releases/tag/20251107
• https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp
• https://lists.debian.org/debian-lts-announce/2025/11/msg00017.html

• Remote code execution in Pdfminer.six
• Debian update for pdfminer
• Fedora EPEL 8 update for python-pdfminer
• Ubuntu update for pdfminer
• openEuler 24.03 LTS SP1 update for python-pdfminer.six
• openEuler 24.03 LTS SP3 update for python-pdfminer.six