CVE-2025-71323CWE-184

CVE-2025-71323

Critical · published June 17, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00991 · 62.2th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-06-17T21:16Z
References (3)
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4675-36f9-wf6r · [email protected]https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-unblocked-ctypes-module · [email protected]https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4675-36f9-wf6r · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 JUN 15:05Z
    picklescan - Remote Code Execution via Unblocked ctypes Module
    cvelistv5