CVE-2025-71347: picklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_eval
picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.parameval function in reduce methods, allowing attackers to bypass security checks. Remote attackers can embed undetected code in pickle files that executes during deserialization, enabling arbitrary code execution in applications loading untrusted pickle data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
picklescanto a version that resolves this vulnerability.Fixed in 0.0.33
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71347?
The severity of CVE-2025-71347 is rated as high with a CVSS score of 8.1.
How do I fix CVE-2025-71347?
To fix CVE-2025-71347, update picklescan to version 0.0.33 or later.
What type of vulnerability is CVE-2025-71347?
CVE-2025-71347 is a remote code execution vulnerability in the picklescan library.
Who is affected by CVE-2025-71347?
Any users of picklescan versions before 0.0.33 are affected by CVE-2025-71347.
What can attackers do with CVE-2025-71347?
Attackers can exploit CVE-2025-71347 to execute arbitrary code during the deserialization of malicious pickle files.