CVE-2025-71365: picklescan RCE Detection Evasion via numpy.f2py.crackfortran

Technical summary

CVE-2025-71365 is a detection evasion vulnerability in picklescan prior to version 0.0.33. The flaw stems from incomplete validation logic that fails to recognize malicious pickle bytecode when the reduce opcode is chained with numpy.f2py.crackfortran.myeval. The numpy.f2py module, intended for Fortran code generation, exposes a crackfortran.myeval function that can be leveraged as a gadget chain to achieve arbitrary code execution. Attackers craft pickle streams that invoke this function through reduce, bypassing picklescan's static analysis and executing remote code upon deserialization.

Business impact

Organizations relying on picklescan to safely process untrusted or third-party pickle files face a critical gap in their defense. If applications use picklescan to gate deserialization of user-supplied data, this vulnerability allows attackers to exfiltrate data, modify system state, install malware, or pivot within trusted networks. Development teams using picklescan for automated security scanning of dependencies or artifact storage may miss malicious code. The impact is highest in environments that handle pickle files from external sources and depend on picklescan as a primary control.

Affected systems

Any system running picklescan versions prior to 0.0.33 is affected. The actual risk depends on downstream usage: applications or libraries that deserialize pickle files and rely on picklescan for pre-deserialization validation are vulnerable if they process untrusted pickle data. Python environments with numpy installed are at heightened risk because the gadget chain requires numpy.f2py.crackfortran.myeval to be present.

Exploitability

Exploitation requires moderate effort: an attacker must craft a malicious pickle file and deliver it to a target that uses vulnerable picklescan. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network accessibility, low complexity, no special privileges needed, and user interaction required—meaning a victim must load or process the file. No zero-click scenario exists. However, once delivered, exploitation is reliable and yields high impact (code execution with process privileges).

Remediation

Upgrade picklescan to version 0.0.33 or later immediately. This release patches the detection logic to recognize reduce chains targeting numpy.f2py.crackfortran.myeval. Simultaneously, audit all pickle deserialization workflows: verify that untrusted pickle data is either rejected outright, deserialized in sandboxed processes, or validated by alternative means. Consider whether pickle is the right format for exchanging data with untrusted sources; JSON or Protocol Buffers are safer alternatives.

Patch guidance

Apply picklescan 0.0.33 or later by updating the package via pip or your package manager. Verify the upgrade in your environment by confirming the installed version matches or exceeds 0.0.33. Test your application's pickle handling logic against the updated tool to confirm no regressions. If picklescan is bundled in a larger application, coordinate the update with your vendor or release cycle. Prioritize production and data-processing systems that handle pickle files from external or user-supplied sources.

Detection guidance

Monitor for attempts to load or scan pickle files with older picklescan versions by checking application logs and version strings in dependency manifests. Search your codebase and CI/CD pipelines for uses of picklescan and ensure all are using 0.0.33+. If you have samples of pickle files processed in recent months, re-validate them with the patched version. Intrusion detection systems may flag suspicious numpy.f2py imports or unusual deserialization patterns, though this gadget is not commonly detected by generic rules; focus on process-level monitoring for unexpected child processes or network activity following pickle deserialization.

Why prioritize this

This is a HIGH severity vulnerability with a CVSS score of 8.1. It exploits a fundamental weakness in a security tool—the tool that organizations trust to prevent exactly this kind of attack. The gap in detection creates a false sense of security, making it a priority for any team using picklescan. The requirement for user interaction lowers urgency slightly compared to wormable flaws, but only marginally; many pickle files are processed automatically. Organizations should treat this as a high-priority patch given the severity and the trust relationship involved.

Risk score, explained

The CVSS 8.1 (HIGH) reflects high confidentiality and integrity impact (an attacker gains code execution and can read or modify data), combined with network-based attack vector and low complexity. User interaction is required, preventing a maximum score. The attack surface is determined by how widely picklescan is deployed and whether applications actually rely on it to filter pickle input. For organizations using picklescan as a first-line defense against malicious pickle files, the real-world risk is severe.

Frequently asked questions