The pdfminer.six library is susceptible to remote code execution when processing specially crafted PDF files, posing a severe risk to any application that uses this tool for document parsing.

The vulnerability exists in the CMapDB._load_data() function, which utilizes pickle.loads() to deserialize data. An attacker can supply a malicious PDF that points to a crafted pickle file, leading to arbitrary code execution upon processing.

This vulnerability carries a high CVSS score of 8.6, reflecting the potential for total system compromise. Successful exploitation allows an attacker to execute arbitrary code within the context of the application processing the PDF, which could lead to unauthorized data access, system disruption, or full host takeover.

Immediate Action: Update the pdfminer-six package to version 20251107 or later immediately.

Proactive Monitoring: Review application logs for unusual file system access or unexpected process execution occurring during PDF parsing operations.

Compensating Controls: Implement strict input validation to sanitize PDF files before processing and run the document parsing logic within a restricted, sandboxed environment to limit the impact of potential code execution.

Public Exploit Available: Yes, multiple public proofs-of-concept exist on GitHub.

Given the availability of public proof-of-concept code and the high potential for arbitrary code execution, this vulnerability represents a significant security risk. Administrators and developers must prioritize upgrading the pdfminer.six library to version 20251107 across all environments. Failure to patch will leave systems vulnerable to exploitation via weaponized PDF documents.