UnratedFix available

UBUNTU-CVE-2025-70559

Type: advisorySource: OSV1 source record

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.

Announced 3 Feb 2026Group revision 1

Original source ↗

UBUNTU-CVE-2025-70559

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2025-70559

pdfminer

Source reference: /affected/0/package/name

Affected versions: 20110515+dfsg-1
Source reference: /affected/0/versions
20140328+dfsg-1
Source reference: /affected/0/versions
Fixed versions: 20140328+dfsg-1ubuntu0.16.04.1~esm1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

pdfminer

Source reference: /affected/1/package/name

Affected versions: 20140328+dfsg-1
Source reference: /affected/1/versions
Fixed versions: 20140328+dfsg-1ubuntu0.18.04.1~esm1
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

pdfminer

Source reference: /affected/2/package/name

Affected versions: 20181108+dfsg-3
Source reference: /affected/2/versions
20191020+dfsg-1
Source reference: /affected/2/versions
20191020+dfsg-2
Source reference: /affected/2/versions
Fixed versions: 20191020+dfsg-2ubuntu0.1~esm1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

pdfminer

Source reference: /affected/3/package/name

Affected versions: 20200726-1
Source reference: /affected/3/versions
20201018+dfsg-1
Source reference: /affected/3/versions
20220319+dfsg-1
Source reference: /affected/3/versions
Fixed versions: 20220319+dfsg-1ubuntu0.1~esm1
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

pdfminer

Source reference: /affected/4/package/name

Affected versions: 20221105+dfsg-1
Source reference: /affected/4/versions
Fixed versions: 20221105+dfsg-1ubuntu0.1~esm1
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

pdfminer

Source reference: /affected/5/package/name

Affected versions: 20221105+dfsg-1
Source reference: /affected/5/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "20140328+dfsg-1ubuntu0.16.04.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "pdfminer",
      "purl": "pkg:deb/ubuntu/pdfminer?arch=source&distro=esm-apps-legacy%2Fxenial",
      "ecosystem": "Ubuntu:Pro:16.04:LTS"
    },
    "versions": [
      "20110515+dfsg-1",
      "20140328+dfsg-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-70559.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "pdfminer-data",
          "binary_version": "20140328+dfsg-1ubuntu0.16.04.1~esm1"
        },
        {
          "binary_name": "python-pdfminer",
          "binary_version": "20140328+dfsg-1ubuntu0.16.04.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "20140328+dfsg-1ubuntu0.18.04.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "pdfminer",
      "purl": "pkg:deb/ubuntu/pdfminer?arch=source&distro=esm-apps%2Fbionic",
      "ecosystem": "Ubuntu:Pro:18.04:LTS"
    },
    "versions": [
      "20140328+dfsg-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-70559.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "pdfminer-data",
          "binary_version": "20140328+dfsg-1ubuntu0.18.04.1~esm1"
        },
        {
          "binary_name": "python-pdfminer",
          "binary_version": "20140328+dfsg-1ubuntu0.18.04.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "20191020+dfsg-2ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "pdfminer",
      "purl": "pkg:deb/ubuntu/pdfminer?arch=source&distro=esm-apps%2Ffocal",
      "ecosystem": "Ubuntu:Pro:20.04:LTS"
    },
    "versions": [
      "20181108+dfsg-3",
      "20191020+dfsg-1",
      "20191020+dfsg-2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-70559.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "pdfminer-data",
          "binary_version": "20191020+dfsg-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "python3-pdfminer",
          "binary_version": "20191020+dfsg-2ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "20220319+dfsg-1ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "pdfminer",
      "purl": "pkg:deb/ubuntu/pdfminer?arch=source&distro=esm-apps%2Fjammy",
      "ecosystem": "Ubuntu:Pro:22.04:LTS"
    },
    "versions": [
      "20200726-1",
      "20201018+dfsg-1",
      "20220319+dfsg-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-70559.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "pdfminer-data",
          "binary_version": "20220319+dfsg-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "python3-pdfminer",
          "binary_version": "20220319+dfsg-1ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "20221105+dfsg-1ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "pdfminer",
      "purl": "pkg:deb/ubuntu/pdfminer?arch=source&distro=esm-apps%2Fnoble",
      "ecosystem": "Ubuntu:Pro:24.04:LTS"
    },
    "versions": [
      "20221105+dfsg-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-70559.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "pdfminer-data",
          "binary_version": "20221105+dfsg-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "python3-pdfminer",
          "binary_version": "20221105+dfsg-1ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "pdfminer",
      "purl": "pkg:deb/ubuntu/pdfminer?arch=source&distro=questing",
      "ecosystem": "Ubuntu:25.10"
    },
    "versions": [
      "20221105+dfsg-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-70559.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "pdfminer-data",
          "binary_version": "20221105+dfsg-1"
        },
        {
          "binary_name": "python3-pdfminer",
          "binary_version": "20221105+dfsg-1"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #23720 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:23:51 GMT
Publisher date: Tue, 03 Feb 2026 18:16:00 GMT

Read the original announcement

Revision history

25 Oct 2026UBUNTU-CVE-2025-70559 · Revision 1Source updated