CVE-2025-70559

What it actually does

pdfminer.six’s CMap cache loader deserializes cache files with Python pickle and does not validate origin, integrity, or object type. A crafted cache file is reconstituted in-process, so untrusted objects can run in the interpreter of whichever trusted worker loads CMaps during PDF parsing. Impact is arbitrary code execution or privilege escalation in that process. This is a residual deserialization flaw after an incomplete fix for CVE-2025-64512; earlier patches for that issue do not fully close this path. Scored impact is unauthorized disclosure and modification (CVSS 6.5, C:L/I:L/A:N) when a reachable cache location is attacker-writable.

Why it matters to the business

PDF-processing services and container images that ship affected pdfminer.six—including Istio FIPS 1.26 MinimOS packages (istio, istio-cni, istioctl and completions, istio-install-cni, istio-pilot-agent, istio-pilot-discovery)—can have document-handling or mesh-adjacent processes hijacked, enabling data theft, unauthorized change, or a foothold for further intrusion. Organizations that only applied the prior related patch may still be exposed. Likelihood remains low: not in KEV, not associated with ransomware, exploit maturity none, EPSS about 0.003 with a modest 30-day rise (0.0028 → 0.0030). The issue has been public for many months, so remaining unpatched copies are an accumulating, avoidable operational risk rather than an emergency mass-exploitation event.

How an attack unfolds

An attacker who can place a file where the application reads CMap caches (writable cache directory, shared volume, poisoned build/cache artifact, or other location the process trusts) supplies a pickle-formatted object instead of a legitimate CMap cache. No extra authentication occurs at load time. When a trusted process later parses a PDF or otherwise initializes CMaps, pickle reconstruction runs attacker-controlled logic as that process user, yielding code execution or escalation. Follow-on activity is whatever that process identity can already do (read local data, alter files, talk to nearby services). There are no named threat actors or KEV campaigns tied to this CVE; public exploit maturity is none.

How to fix it

Upgrade pdfminer.six to 20251230 or later, or to git commit 7094c9d3b2d732af4d017ff7bf390939ccdc72e9. Do not treat a CVE-2025-64512-only patch as sufficient. For MinimOS Istio FIPS 1.26 images, move all listed packages to 1.26.6-r2 or newer: istio-fips-1.26, istio-cni-fips-1.26, istioctl-fips-1.26, istioctl-bash-completion-fips-1.26, istioctl-zsh-completion-fips-1.26, istio-install-cni-fips-1.26, istio-pilot-agent-fips-1.26, and istio-pilot-discovery-fips-1.26. Rebuild and redeploy images so the old library is not left in layers. Until upgraded, restrict write access to CMap cache directories to install/update identities only, run PDF parsers with least privilege and no shared writable cache across trust boundaries, and block untrusted content from landing in those directories.

How to confirm the fix worked

Inventory SBOM/SCA results for pdfminer.six earlier than 20251230 and for Istio FIPS 1.26 MinimOS packages older than 1.26.6-r2. Confirm running images and virtualenvs actually load the fixed commit or version (not a leftover site-packages copy). After upgrade, verify CMap loading no longer unpickles untrusted cache files and that cache directories are not world- or cross-tenant writable. Regression-test PDF text extraction with legitimate CMaps, then confirm permission and integrity checks on cache paths. Re-scan images and lockfiles so the vulnerable component does not re-enter via a transitive dependency.

Typical attack path

1. Locate a deployment that still uses pdfminer.six before 20251230 or an unfixed Istio FIPS 1.26 MinimOS image, and identify a CMap cache path that process can read.
2. Obtain write influence on that path (local write, shared filesystem, supply-chain/cache poisoning, or a weaker adjacent component).
3. Replace or add a CMap cache file that is a malicious pickle rather than a benign cache.
4. Wait for or induce PDF/CMap loading in a trusted worker so pickle deserialization runs in-process.
5. Use the resulting process-context execution for data access, persistence, or movement consistent with that identity.

How to detect it

Assume compromise only if evidence shows a non-install writer touching CMap caches and a subsequent trusted PDF/CMap load—not merely presence of the vulnerable library. Review file-integrity and audit logs for creates/modifies under pdfminer CMap/cache paths by application or non-packager users; container layer and volume diffs for unexpected .pkl/.pickle/pickle-gzip files beside CMaps; process telemetry for PDF workers (Python interpreters importing pdfminer) spawning unusual children or loading pickle from cache paths; application logs around CMap initialization and pickle/unpickle errors. There are no named APT mappings; focus on post-publication windows after 2026-02-03 and on hosts that process untrusted PDFs or share cache volumes. Successful exploitation may leave no distinct network IOC because the trigger is local file load.

• pdfminer/cmap
• pdfminer\\cmap
• cmap.pickle
• cmap.pkl
• *.pickle.gz
• pickle.load
• CMapDB
• pdfminer.high_level
• pdfminer.converter
• __pycache__/cmap

What your security team should do

• Patch pdfminer.six to 20251230+ (commit 7094c9d3b2d732af4d017ff7bf390939ccdc72e9) and Istio FIPS 1.26 MinimOS packages to 1.26.6-r2; treat leftover CVE-2025-64512-only fixes as still vulnerable.
• Rebuild/redeploy affected images and purge old layers and cached wheels so the vulnerable library cannot be imported.
• Lock down CMap cache directories (ownership, no shared writable volumes, no untrusted write paths) and least-privilege PDF parsing workers.
• Hunt historically for unexpected pickle/cache files and anomalous child processes from PDF parsers (see detection_guidance); EPSS is low and there is no KEV/ransomware mapping, so prioritize by exposure of writable caches rather than emergency internet-wide response.
• Add SCA policy to fail builds on pdfminer.six < 20251230 and on the unfixed Istio FIPS 1.26 MinimOS package set.