python-pdfminer.six security update
PDF parser and analyzer. Security Fix(es): pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.(CVE-2025-70559)
OESA-2026-4210
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:OESA-2026-4210
python-pdfminer.six
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 20231228-4.oe2403sp3
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20231228-4.oe2403sp3"
}
]
}
],
"package": {
"name": "python-pdfminer.six",
"purl": "pkg:rpm/openEuler/python-pdfminer.six&distro=openEuler-24.03-LTS-SP3",
"ecosystem": "openEuler:24.03-LTS-SP3"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4210.json"
},
"ecosystem_specific": {
"src": [
"python-pdfminer.six-20231228-4.oe2403sp3.src.rpm"
],
"noarch": [
"python-pdfminer.six-help-20231228-4.oe2403sp3.noarch.rpm",
"python3-pdfminer.six-20231228-4.oe2403sp3.noarch.rpm"
]
}
}
]Publisher severity
medium
Source reference: /database_specific/severity
- Event
- #52162 · Revision 1
- Added to Heist Feed
- Publisher date