py-pdfminer.six -- Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

2025-11-17 · CVE-2025-64512 · VuXML entry

Pieter Marsman reports: pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB._load_data() function in pdfminer.six uses pickle.loads() to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the cmap/ directory, but a malicious PDF can specify an alternative directory and filename as long as …

Affected versions

• py310-pdfminer.six, py311-pdfminer.six, py312-pdfminer.six, py313-pdfminer.six, py313t-pdfminer.six, py314-pdfminer.six < 20251230

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.