Arbitrary Code Execution in Pdfminer.six by Malicious PDF Files

CVE-2025-64512

What is CVE-2025-64512?

Pdfminer.six, an open-source library for extracting information from PDF documents, is vulnerable to arbitrary code execution due to improper handling of malicious pickle files embedded in specially crafted PDF files. Specifically, the issue arises from the CMapDB._load_data() function that utilizes pickle.loads() for deserialization tasks without adequate validation. Attackers can exploit this vulnerability by providing a PDF that points to a malicious pickle file, which can execute arbitrary code when processed. This flaw impacts versions prior to 20251107, making it crucial for users to upgrade to this version or later to protect their systems from potential exploitation.

References