Insecure Deserialization Vulnerability in pdfminer.six by the Vendor pdfminer
CVE-2025-70559

6.5MEDIUM

Key Information:

Vendor

pdfminer

Status
pdfminer.six
Vendor
CVE Published:
3 February 2026

What is CVE-2025-70559?

The pdfminer.six library, prior to version 20251230, exhibits an insecure deserialization vulnerability in the CMap loading process. By utilizing Python's pickle, the library deserializes CMap cache files without implementing proper validation. This flaw allows an attacker, having the capability to place a malicious pickle file in a location that the application can access, to execute arbitrary code or escalate privileges when the application processes the compromised file. This issue is rooted in an incomplete patch addressing a previous vulnerability.

References

https://github.com/pdfminer/pdfminer.six/security/advisor...
https://github.com/advisories/GHSA-f83h-ghpp-7wcc

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.