Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the issue.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4686d11563 advisory.

    Backport fix for CVE-2025-64512 / GHSA-wf5f-4jwr-ppcp

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e77e051f0c advisory.

    Update to 20251230: security fix for CVE-2025-64512

    https://github.com/pdfminer/pdfminer.six/blob/20251230/CHANGELOG.md



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6062 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6062-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     November 25, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : pdfminer     CVE ID         : CVE-2025-64512     Debian Bug     : 1120642

    A vulnerability was discovered in pdfminer, a tool for extracting     information from PDF documents, which may result in the execution of     arbitrary code if a specially crafted PDF file is processed.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 20221105+dfsg-1.1~deb12u1.

    For the stable distribution (trixie), this problem has been fixed in     version 20221105+dfsg-1.1~deb13u1.

    We recommend that you upgrade your pdfminer packages.

    For the detailed security status of pdfminer please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/pdfminer

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4374 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4374-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     November 18, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : pdfminer     Version        : 20200726-1+deb11u1     CVE ID         : CVE-2025-64512     Debian Bug     : 1120642

    It was discovered that there was a potential arbitrary code execution     in pdfminer, a tool for extracting information from PDF documents. A     malicious, zipped pickle file could have contained code that might     have been executed when the PDF was processed.

    For Debian 11 bullseye, this problem has been fixed in version     20200726-1+deb11u1.

    We recommend that you upgrade your pdfminer packages.

    For the detailed security status of pdfminer please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/pdfminer

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-453047be66 advisory.

    Backport security fix for GHSA-wf5f-4jwr-ppcp / CVE-2025-64512



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-63872f52bb advisory.

    Update to 20251107

    Fix: arbitary code execution when loading pickle font files

    Security fix for [GHSA-wf5f-4jwr-ppcp](https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-     wf5f-4jwr-ppcp) / CVE-2025-64512


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d019d16668 advisory.

    Backport security fix for GHSA-wf5f-4jwr-ppcp / CVE-2025-64512


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information     from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious     pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses     `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the     pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative     directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can     then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the     issue. (CVE-2025-64512)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information
    from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious
    pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses
    `pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the
    pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative
    directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can
    then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the
    issue. (CVE-2025-64512)

ID	Name	Product	Family	Severity
282566	Fedora 42 : python-pdfminer (2026-4686d11563)	Nessus	Fedora Local Security Checks	high
282444	Fedora 43 : python-pdfminer (2025-e77e051f0c)	Nessus	Fedora Local Security Checks	high
276882	Debian dsa-6062 : pdfminer-data - security update	Nessus	Debian Local Security Checks	high
275733	Debian dla-4374 : pdfminer-data - security update	Nessus	Debian Local Security Checks	high
275544	Fedora 42 : python-pdfminer (2025-453047be66)	Nessus	Fedora Local Security Checks	high
275538	Fedora 43 : python-pdfminer (2025-63872f52bb)	Nessus	Fedora Local Security Checks	high
275528	Fedora 41 : python-pdfminer (2025-d019d16668)	Nessus	Fedora Local Security Checks	high
274731	Linux Distros Unpatched Vulnerability : CVE-2025-64512	Nessus	Misc.	high
436000	SCA: security update for pdfminer.six (GHSA-wf5f-4jwr-ppcp)	Tenable Cloud Security	SCA Checks	high
436000	SCA: security update for pdfminer.six (GHSA-wf5f-4jwr-ppcp)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-64512

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high