CVE-2025-71372: Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget

Q: What is the severity of CVE-2025-71372?

CVE-2025-71372 has a severity rating of 8.1, classified as high.

Q: What type of vulnerability is CVE-2025-71372?

CVE-2025-71372 is an arbitrary code execution vulnerability.

Q: How do I fix CVE-2025-71372?

To fix CVE-2025-71372, upgrade Picklescan to version 0.0.33 or later.

Q: What software is affected by CVE-2025-71372?

CVE-2025-71372 affects Picklescan versions prior to 0.0.33.

Q: What can attackers do with CVE-2025-71372?

Attackers can execute arbitrary Python code by crafting malicious pickle files that bypass safety checks.

Published Jul 4, 2026

Updated

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle reduce methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks and enabling supply-chain poisoning of shared model files.

Affected Software

1 affected component

picklescan<0.0.33

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Picklescan to a version that resolves this vulnerability.
Fixed in 0.0.33

Event History

Jul 4, 2026

CVE Published

via MITRE·01:23 AM

Data Sourced

via MITRE·01:23 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Apr 28, 58475

Event

via NVD·08:46 AM

Frequently Asked Questions

What is the severity of CVE-2025-71372?

CVE-2025-71372 has a severity rating of 8.1, classified as high.

What type of vulnerability is CVE-2025-71372?

CVE-2025-71372 is an arbitrary code execution vulnerability.

How do I fix CVE-2025-71372?

To fix CVE-2025-71372, upgrade Picklescan to version 0.0.33 or later.

What software is affected by CVE-2025-71372?