Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
pdfminer-six versions before 20251230 are affected. A local user who can write to a directory in the CMap search path can place a crafted pickle-based CMap file there, which pdfminer-six deserializes when a privileged process loads that CMap, leading to arbitrary code execution with that process's privileges. Upgrade to pdfminer-six 20251230 or later. The source gives few workaround details beyond keeping untrusted users out of CMap search directories.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.8 | High | 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.0032, the 25th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:05 UTC First seen by agentprime
- 31 Oct 2026, 15:05 UTC Confirmed by OSV