What’s Vulnerable › Vulnerabilities

CVE-2025-71325: picklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic Flaw

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-17 · updated 2026-10-12
• Weakness: CWE-391

Description

picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.

Affected products

• picklescan: before 0.0.27 — fixed in 0.0.27

How to fix

Upgrade to a fixed version: picklescan 0.0.27. Check the vendor advisory for mitigations.

References

• https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f
• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr
• https://www.vulncheck.com/advisories/picklescan-detection-bypass-via-stack-global-opcode-parsing-logic-flaw
• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr

Get alerted when CVE-2025-71325 or the next vulnerability affects your stack