VYPR
← All advisories
Medium severity6.5OSV Advisory· Published Feb 3, 2026· Updated Apr 15, 2026

CVE-2025-70559

CVE-2025-70559

Description

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pdfminer.sixPyPI
< 2025123020251230

Affected products

1

Patches

1
b808ee05dd7f

Fix: arbitary code execution when loading pickle font files

https://github.com/pdfminer/pdfminer.sixScott TolleyNov 7, 2025via ghsa
commit
1 file changed · +8 −2
  • pdfminer/cmapdb.py+8 −2 modified
    @@ -240,8 +240,14 @@ def _load_data(cls, name: str) -> Any:
         )
         for directory in cmap_paths:
             path = os.path.join(directory, filename)
-            if os.path.exists(path):
-                gzfile = gzip.open(path)
+            # Resolve paths to prevent directory traversal
+            resolved_path = os.path.realpath(path)
+            resolved_directory = os.path.realpath(directory)
+            # Check if resolved path is within the intended directory
+            if not resolved_path.startswith(resolved_directory + os.sep):
+                continue
+            if os.path.exists(resolved_path):
+                gzfile = gzip.open(resolved_path)
                 try:
                     return type(str(name), (), pickle.loads(gzfile.read()))
                 finally:

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.