CVE-2025-61622

Published Oct 1, 2025

Last updated 6 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-61622 describes a deserialization of untrusted data vulnerability affecting Apache Pyfory (pyfory versions 0.12.0 through 0.12.2) and legacy Pyfury (versions 0.1.0 through 0.10.3). This flaw allows for arbitrary code execution if an application processes serialized data from untrusted sources. The vulnerability stems from an unguarded `pickle-fallback serializer`. An attacker can exploit this by crafting a malicious data stream that, when deserialized, forces the application to use `pickle.loads`, which is susceptible to remote code execution. Users are advised to upgrade to Pyfory version 0.12.3 or later, as this version addresses the issue by removing the problematic `pickle fallback serializer`.

Description: Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution. Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.
Source: security@apache.org
NVD status: Analyzed
Products: fory

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@apache.org: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6CDF1C62-3007-4137-AFBA-9EBB78508E22",
            "versionEndIncluding": "0.10.3",
            "versionStartIncluding": "0.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B2E53C07-98C5-4EC3-985C-7C635D7A3CD8",
            "versionEndIncluding": "0.12.2",
            "versionStartIncluding": "0.12.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.