Skip to content
OpenAdvisories
High USN-8837-1 2 CVEs

pdfminer vulnerabilities

Published Sep 28, 2026 · Updated Sep 28, 2026

Ecosystem: Ubuntu

Summary

It was discovered that pdfminer did not safely parse specially crafted
PDF files. An attacker could possibly use these issues to execute
arbitrary code. (CVE-2025-64512, CVE-2025-70559)

Fixed packages 5

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS pdfminer 20140328+dfsg-1ubuntu0.16.04.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS pdfminer 20140328+dfsg-1ubuntu0.18.04.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS pdfminer 20191020+dfsg-2ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS pdfminer 20220319+dfsg-1ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS pdfminer 20221105+dfsg-1ubuntu0.1~esm1

Vulnerabilities 2

  • High 8.6
    CVE-2025-64512 Public exploit

    pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

    Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file.…

    pdfminer pdfminer.six pdfminer-six pdfminer Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2025-70559 Public exploit

    Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

    pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in …

    pdfminer-six pdfminer pdfminer Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2025-64512
  • report
    https://ubuntu.com/security/CVE-2025-70559