CVE-2025-64512

What it actually does

pdfminer.six insecurely deserializes CMap data: CMapDB._load_data() calls pickle.loads() on gzip-compressed pickle files that are meant to live only in the packaged cmap/ directory. A malicious PDF can redirect that loader to an alternate directory and filename as long as the name ends in .pickle.gz, so parsing the document executes arbitrary Python in the pdfminer (or embedding GeoServer gs-wfs) process with that process's privileges.

Why it matters to the business

Any pipeline that extracts text or metadata from untrusted PDFs—document ingestion, search indexing, GIS/WFS services using GeoServer gs-wfs—can be fully compromised, enabling data theft, ransomware staging, or a foothold on document-processing hosts. Impact is high (CVSS 8.6) wherever PDFs are parsed automatically and without a sandbox. Urgency is tempered but not removed: the issue is not in CISA KEV, is not tied to ransomware campaigns, exploit maturity is none, and EPSS remains low and flat (~0.003 over 30 days). After 325 days unpatched parsers are still a serious residual risk rather than an active mass-exploitation event.

How an attack unfolds

An attacker supplies a PDF that causes the CMap loader to read a gzip-compressed pickle from a location they control instead of the library's bundled cmap/ files. Because the loader trusts pickle.loads() on that content, deserialization runs attacker-chosen Python in the process that parsed the PDF. Delivery can be a file upload, email or ticket attachment, harvested document in a batch pipeline, or a request that leads GeoServer WFS to process the file. After code execution the attacker can run commands, steal data, or abuse the host's credentials and network. No named threat actors or ransomware campaigns are associated with this CVE and public exploit maturity is none, so confirmed activity would indicate opportunistic or targeted use of an unpatched parser rather than a known mass campaign.

How to fix it

Upgrade pdfminer.six to a build that includes commit b808ee05dd7f0c8ea8ec34bdf394d40e63501086 (or a later official release containing that fix). Upgrade org.geoserver:gs-wfs to 2.25.2 (2.25 line) or 2.24.4 (2.24 line) and redeploy. Until patched, do not parse untrusted PDFs with pdfminer.six; isolate remaining parsers in a least-privilege sandbox with no outbound network and no write access outside a scratch directory; and ensure the process cannot read unexpected *.pickle.gz files (application allow-list of the packaged cmap/ directory only). Rebuild and redeploy images or lockfiles so transitive copies of pdfminer.six and gs-wfs are not left behind.

How to confirm the fix worked

Inventory Python environments and lockfiles for pdfminer.six and confirm the installed revision includes b808ee05dd7f0c8ea8ec34bdf394d40e63501086 or newer. For GeoServer, confirm gs-wfs is 2.25.2+, 2.24.4+, or another patched line. Dependency-scan Maven and Git artifacts (org.geoserver:gs-wfs, pdfminer/pdfminer.six). After upgrade, confirm CMap loading no longer accepts attacker-specified directories or pickle.loads() of non-bundled files, and that runtime hosts no longer ship unpatched copies in virtualenvs, containers, or fat JARs.

Typical attack path

1. Deliver a PDF to a user or service that parses documents with vulnerable pdfminer.six or affected GeoServer gs-wfs.
2. Cause CMap loading to resolve an attacker-influenced path whose filename ends in .pickle.gz rather than packaged cmap/ data.
3. CMapDB._load_data() decompresses the file and deserializes it with pickle.loads().
4. Attacker code runs in the PDF-processing process under that service account.
5. Use the resulting access to steal data, persist, or move to connected systems.

How to detect it

This CVE has no public exploit maturity, is not in KEV, and is not linked to named actors or ransomware, so look for one-off abuse of PDF parsers rather than a known campaign. Review application, GeoServer, and Python worker logs around PDF ingest for CMap load errors, pickle exceptions, and paths ending in .pickle.gz outside the packaged cmap/ directory. On hosts that ran pdfminer.six or gs-wfs, inspect process trees for the parser spawning shells or unexpected children at document-processing time; check the filesystem for recently created or read *.pickle.gz files not shipped with the library; and correlate inbound PDF uploads with subsequent anomalous outbound connections or new persistence on the same worker. Preserve any suspect PDFs and the parser's working directory for forensic review.

• .pickle.gz
• CMapDB._load_data
• pdfminer.cmapdb
• pickle.loads
• pickle.UnpicklingError
• cmap/*.pickle.gz
• ../**/*.pickle.gz

What your security team should do

• Patch pdfminer.six to commit b808ee05dd7f0c8ea8ec34bdf394d40e63501086 or later and GeoServer gs-wfs to 2.25.2 or 2.24.4 immediately on any host that parses untrusted PDFs.
• Stop untrusted PDF ingestion (or move it into a tightly sandboxed worker) until those upgrades are verified.
• Hunt software composition and container images for leftover vulnerable pdfminer.six and gs-wfs, including transitive and vendored copies.
• Review historical PDF-processing logs and worker process trees for signs of prior deserialization (see detection_guidance); EPSS is low and KEV is false, so treat confirmed hits as targeted rather than mass exploitation.
• Add preventative controls: restrict cmap/ to packaged files, block pickle deserialization of untrusted input, and alert on unexpected *.pickle.gz reads during PDF parse.