Back Ubuntu

USN-8837-1: pdfminer vulnerabilities

Ubuntu • September 28, 2026

pdfminer could be made to run programs as your login if it opened a specially crafted file.

pdfminer - PDF parser and analyser

It was discovered that pdfminer did not safely parse specially crafted PDF files. An attacker could possibly use these issues to execute arbitrary code. ( CVE-2025-64512 , CVE-2025-70559 )

In general, a standard system update will make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in pdfminer Allow Code Execution on Ubuntu Systems Two vulnerabilities (CVE-2025-64512 and CVE-2025-70559) in pdfminer, a PDF parser used in Ubuntu systems, could allow attackers to execute arbitrary code by opening specially crafted PDF files. The vulnerabilities were discovered in the parsing process of pdfminer, which failed to handle maliciously crafted files safely. Affected systems include Ubuntu 24.04 LTS, 22.04 LTS, 20.04 LTS, 18.04 LTS, and 16.04 LTS. Users are advised to update their systems to the latest package versions to mitigate the risk. The vulnerabilities were publicly disclosed, with CVE-2025-64512 published on November 10, 2025, and CVE-2025-70559 published on February 3, 2026. A standard system update is recommended to apply the necessary patches. The urgency of the situation is heightened by the potential for exploitation. CISA has confirmed the existence of these vulnerabilities, emphasizing the need for immediate action. 2 sources 72

Extracted Entities

CVEs (2)

CVE-2025-64512 CVE-2025-70559