CVE-2025-64512

Katalog CVE

CVSS 7.8 · High EPSS 0,33%

Kerentanan Deserialization of Untrusted Data pada pdfminer.six, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.

Rincian

Terbit di NVD

10 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp exploit · advisory vendor
• https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086 patch
• https://github.com/pdfminer/pdfminer.six/releases/tag/20251107 release notes
• https://lists.debian.org/debian-lts-announce/2025/11/msg00017.html mailing list
• https://lists.debian.org/debian-lts-announce/2026/01/msg00005.html