CVE-2025-71374

Received Received - Intake

Code Execution in Picklescan via Profile.run Bypass

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2025-71374

EUVD

EUVD-2025-210392

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

The vulnerability exists in picklescan versions before 0.0.29, where it fails to detect the built-in Python function profile.Profile.run when used in pickle reduce methods.

This failure allows attackers to craft malicious pickle files that bypass picklescan's detection mechanisms.

When these malicious pickle files are deserialized, they can execute arbitrary code on the target system.

Impact Analysis

This vulnerability can allow remote attackers to execute arbitrary code on your system by tricking it into deserializing malicious pickle files.

Because the vulnerability has a high impact on confidentiality and integrity (as indicated by the CVSS scores), it can lead to unauthorized access to sensitive data and manipulation of system behavior.

The attack requires no privileges and can be performed remotely, making it a significant security risk.

Hi! I’m here to help you understand CVE-2025-71374. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70