debian/pdfminer vulnerabilities

Latest debian/pdfminer CVEs

Newest publication first

1. CVE-2025-70559 Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

   Published 2026-02-03

   Medium·CVSS 6.5 EPSS 0.32%

   pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible...

2. DLA-4374-2 pdfminer - regression update

   Published 2026-01-08

   Unknown

3. DSA-6062-1 pdfminer - security update

   Published 2025-11-25

   Unknown

4. DLA-4374-1 pdfminer - security update

   Published 2025-11-18

   Unknown

5. CVE-2025-64512 pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

   Published 2025-11-10

   High·CVSS 7.8 EPSS 0.33%

   Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB._load_dat...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.