Description
Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pdfminer | pdfminer.six | < 20251107 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pdfminer | 20221105+dfsg-1.1 | — |
| Debian 13 | pdfminer | 20221105+dfsg-1.1~deb13u1 | DSA-6062-1 |
| Debian 12 | pdfminer | 20221105+dfsg-1.1~deb12u1 | DSA-6062-1 |
| Debian 11 | pdfminer | 20200726-1+deb11u1 | DLA-4374-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | pdfminer | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | pdfminer | 20221105+dfsg-1ubuntu0.1~esm1 | USN-8837-1 |
| Ubuntu Pro 22.04 LTS | pdfminer | 20220319+dfsg-1ubuntu0.1~esm1 | USN-8837-1 |
| Ubuntu Pro 20.04 LTS | pdfminer | 20191020+dfsg-2ubuntu0.1~esm1 | USN-8837-1 |
| Ubuntu Pro 18.04 LTS | pdfminer | 20140328+dfsg-1ubuntu0.18.04.1~esm1 | USN-8837-1 |
| Ubuntu Pro 16.04 LTS | pdfminer | 20140328+dfsg-1ubuntu0.16.04.1~esm1 | USN-8837-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-pdfminer.six | 20251107-1.1 | openSUSE-SU-2025:15727-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 10 repositories
-
luigigubello/CVE-2025-64512-Polyglot-PoC ★ 8 · Dec 11, 2025
A Proof-of-Concept for CVE-2025-64512 using a polyglot file.
-
matesz44/CVE-2025-64512 ★ 4 · Jul 19, 2026
CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads
-
BardLaudian/CVE-2025-64512 ★ 1 · Jul 21, 2026
CLI wrapper around the official PoC for CVE-2025-64512 — pdfminer.six insecure pickle deserialization via crafted PDF (RCE)
-
Jinook-Kim/CVE-2025-64512_PoC ★ 0 · Sep 15, 2026
-
oguzylmzx/CVE-2025-64512-pdfminer-PoC ★ 0 · Aug 15, 2026
PoC for CVE-2025-64512: pdfminer.six CMapDB pickle deserialization RCE via crafted PDF
-
DodgeNefoli/CVE-2025-64512 ★ 0 · Aug 12, 2026
-
saadhassan77/CVE-2025-64512---pdfminer.six-Remote-Code-Execution-RCE- ★ 0 · Jul 27, 2026
-
stoic-crawler/CVE-2025-64512 ★ 0 · Jul 22, 2026
Exploit for CVE-2025-64512 to get a reverse shell.
-
MehdiChyhab/CVE-2025-64512-exploit ★ 0 · Jul 21, 2026
CVE-2025-64512 - pdfminer.six Remote Code Execution Exploit
-
joeack123/PoC-for-CVE-2025-64512 ★ 0 · Jul 19, 2026
PoC script for CVE-2025-64512
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pdfminer-six | < 20251107 | 20251107 | GHSA-wf5f-4jwr-ppcp |
Advisories 4
- USN-8837-1 pdfminer vulnerabilities Ubuntu Security Notices (USN) · Sep 28, 2026
- openSUSE-SU-2025:15727-1 python311-pdfminer.six-20251107-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- DSA-6062-1 pdfminer - security update Debian Security (DSA / DLA) · Nov 25, 2025
- DLA-4374-1 pdfminer - security update Debian Security (DSA / DLA) · Nov 20, 2025