CVE-2025-71339: Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran._eval_length Gadget
Published Jun 22, 2026
·Updated
Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.evallength gadget in pickle reduce methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.
Affected Software
1 affected component
pypi/picklescan<0.0.33
Event History
Jun 22, 2026
CVE Published
via MITRE·09:04 PM
Data Sourced
via MITRE·09:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71339?
CVE-2025-71339 has a severity rating of 7.6, categorized as high risk.
2
How do I fix CVE-2025-71339?
To mitigate CVE-2025-71339, upgrade Picklescan to version 0.0.33 or later.
3
What type of vulnerability is CVE-2025-71339?
CVE-2025-71339 is classified as an arbitrary code execution vulnerability.
4
Who is affected by CVE-2025-71339?
Anyone using Picklescan versions prior to 0.0.33 who loads untrusted pickle files may be affected by CVE-2025-71339.
5
What is the potential impact of CVE-2025-71339?
CVE-2025-71339 could allow attackers to execute arbitrary Python code on a victim's system.