DNA View

High Severity Vulnerability

This vulnerability has been rated as High severity. Immediate action is recommended.

CVE-2025-64512

High

Low Medium High Critical

8.6

CVSS Score

Published: Nov 10, 2025

Last Modified: Jan 08, 2026

CWE: CWE-502

Vulnerability Description

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

1 configuration(s) from 1 vendor(s)

debian_linux

Version:

11.0

CPE:

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

This vulnerability affects 1 software configuration(s). Ensure you patch all affected systems.

Available Security Patches

1 patch available from vendors

View All Patches

SUSE

CVE-2025-64512

Severity

Unknown

Released

Dec 23, 2025

Security Update

View Details Vendor Page

Browse All Security Patches

References & Resources

Severity Details

8.6

out of 10.0

High

Weakness Type (CWE)

CWE-502 Top 25 #15

Deserialization of Untrusted Data

Description: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Exploit Likelihood: Medium
Typical Severity: Medium
OWASP Top 10: A08:2021-Software/Data Integrity Failures
Abstraction Level: Base