CVE-2025-70559

CVSS 6.5 MEDIUMEPSS 0.2%CWE-502

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

03 feb 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in a location accessible to the application can trigger arbitrary code execution or privilege escalation when the file is loaded by a trusted process. This is caused by an incomplete patch to CVE-2025-64512.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Productos afectados

n/a · n/a

Referencias

https://github.com/advisories/GHSA-f83h-ghpp-7wcc https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-f83h-ghpp-7wcc