CVE-2025-61622 | BDVDB-2026-296334 Detail

Description#

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution. Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-10-01Record published in the CVE List.
2. Version 22025-11-04Most recent update recorded in the CVE List.