USN-8837-1: pdfminer vulnerabilities
Ubuntu fixed pdfminer flaws CVE-2025-64512 and CVE-2025-70559 that may allow code execution through crafted PDFs.
Ubuntu published USN-8837-1 for vulnerabilities in pdfminer. The library did not safely parse specially crafted PDF files, and an attacker could possibly use the issues to execute arbitrary code. The flaws are CVE-2025-64512 and CVE-2025-70559. The notice does not say the bugs are being exploited.
- USN-8837-1 covers unsafe parsing of crafted PDF files.
- Tracked as CVE-2025-64512 and CVE-2025-70559.
- Crafted PDFs could possibly lead to arbitrary code execution.
- The notice does not report active exploitation.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-64512 | Pdfminer.six: Pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The… | 7.8 | <1% | PoC ×2 | |
| CVE-2025-70559 | pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism | 6.5 | <1% |
From the original article
It was discovered that pdfminer did not safely parse specially crafted PDF files. An attacker could possibly use these issues to execute arbitrary code. (CVE-2025-64512, CVE-2025-70559)
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.