Detections
Analytics
SCA: security update for pdfminer.six (GHSA-wf5f-4jwr-ppcp)
high Tenable Self-Hosted Container Security Plugin ID 436000
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information
from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious
pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses
`pickle.loads()` to deserialize pickle files. These pickle files are supposed to be part of the
pdfminer.six distribution stored in the `cmap/` directory, but a malicious PDF can specify an alternative
directory and filename as long as the filename ends in `.pickle.gz`. A malicious, zipped pickle file can
then contain code which will automatically execute when the PDF is processed. Version 20251107 fixes the
issue. (CVE-2025-64512)
See Also
Plugin Details
Severity: High
ID: 436000
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 11/8/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.88
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2025-64512
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 7
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/7/2025
Vulnerability Publication Date: 11/7/2025
Reference Information
CVE: CVE-2025-64512
cwe: CWE-502