CVE-2025-61622: Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of pickle.loads, which is vulnerable to remote code execution.
Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pyforyto a version that resolves this vulnerability.Fixed in 0.12.3 - Upgrade
Upgrade
pyforyto a version that resolves this vulnerability.Fixed in 0.12.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61622?
CVE-2025-61622 is rated as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2025-61622?
To fix CVE-2025-61622, upgrade to pyfory version 0.12.3 or later, or ensure that pyfury is at version 0.10.4 or later.
What versions of pyfory are affected by CVE-2025-61622?
CVE-2025-61622 affects pyfory versions 0.12.0 through 0.12.2.
What versions of pyfury are affected by CVE-2025-61622?
CVE-2025-61622 affects pyfury versions from 0.1.0 to 0.10.3.
How does CVE-2025-61622 impact applications using pyfory or pyfury?
CVE-2025-61622 can lead to arbitrary code execution if applications deserialize untrusted data from pyfory or pyfury.