Deserialization of Untrusted Data Affecting pdfminer package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Deserialization of Untrusted Data vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-DEBIAN11-PDFMINER-13883130
- published12 Nov 2025
- disclosed10 Nov 2025
Introduced: 10 Nov 2025
NewCVE-2025-64512 (opens in a new tab)How to fix?
There is no fixed version for Debian:11 pdfminer.
NVD Description
Note: Versions mentioned in the description apply only to the upstream pdfminer package and not the pdfminer package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The CMapDB._load_data() function in pdfminer.six uses pickle.loads() to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the cmap/ directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in .pickle.gz. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.