The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade pdfminer | Feb 5, 2026 | Feb 5, 2026 |
| Ubuntu | — | Upgrade python-pdfminer (Ubuntu Pro)Upgrade python3-pdfminer (Ubuntu Pro) | Sep 29, 2026 | Sep 28, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub