CVE-2025-71372 Picklescan CVE debrief

Who should care

Organizations using Picklescan before version 0.0.33 should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 0.0.33 or later, and being cautious when loading pickle files from untrusted sources. Additionally, developers and security teams should review their supply chain for potential vulnerabilities.

Technical summary

The vulnerability exists in the Picklescan library, which is used to detect and prevent arbitrary code execution in pickle files. The library fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing attackers to craft malicious pickle files that can execute arbitrary Python code when loaded. This can be used to bypass Picklescan's safety checks and enable supply-chain poisoning of shared model files.

Defensive priority

High priority should be given to updating Picklescan to version 0.0.33 or later. Additionally, organizations should be cautious when loading pickle files from untrusted sources and review their supply chain for potential vulnerabilities.

Recommended defensive actions

• Update Picklescan to version 0.0.33 or later
• Be cautious when loading pickle files from untrusted sources
• Review supply chain for potential vulnerabilities
• Monitor for suspicious activity
• Implement additional security controls as needed

Evidence notes

The CVE-2025-71372 vulnerability was published on July 4, 2026, and has a CVSS score of 7.6. The vulnerability exists in Picklescan before version 0.0.33 and allows attackers to craft malicious pickle files that can execute arbitrary Python code when loaded. The vulnerability is considered high severity and organizations should take steps to mitigate it.

Official resources