Deserialization of Untrusted Data in pdfminer.six - CVE-2025-70559

Vulnerability identifier: #VU118814

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-70559

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted PDF file to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

pdfminer.six
Ubuntu
openEuler
pdfminer (Ubuntu package)
python-pdfminer.six
python-pdfminer.six-help
python3-pdfminer.six

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

pdfminer (Ubuntu package) - addressed in versions 20140328+dfsg-1ubuntu0.16.04.1~esm1, 20140328+dfsg-1ubuntu0.18.04.1~esm1, 20191020+dfsg-2ubuntu0.1~esm1, 20220319+dfsg-1ubuntu0.1~esm1, 20221105+dfsg-1ubuntu0.1~esm1
python-pdfminer.six - update to 20231228-4
python-pdfminer.six-help - update to 20231228-4
python3-pdfminer.six - update to 20231228-4

• https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-f83h-ghpp-7wcc

• Deserialization of untrusted data in pdfminer.six
• Ubuntu update for pdfminer
• openEuler 24.03 LTS SP1 update for python-pdfminer.six
• openEuler 24.03 LTS SP3 update for python-pdfminer.six