CVE-2025-71463: Scapy before 2.7.0 Insecure Deserialization RCE via Session Files
Scapy before 2.7.0 contains an insecure deserialization vulnerability in the loadsession function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through reduce().
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must provide a malicious pickle-compressed session file and convince a user to load it. Loading can occur through Scapy's -s option or by using conf.session.
Are systems vulnerable without user interaction?
The provided information indicates user interaction is required. A user must load the crafted .pkl.gz session file before the embedded Python code executes.
Which Scapy versions are affected?
Scapy versions before 2.7.0 are affected. Upgrading to 2.7.0 or later removes the affected version range described here.
What can be done if upgrading is not immediately possible?
Do not load session files from untrusted or unverifiable sources. In particular, avoid passing untrusted files with -s and avoid setting conf.session to an untrusted .pkl.gz file.