Deserialization Vulnerability in Pyfory and Legacy Pyfury Software

CVE-2025-61622

What is CVE-2025-61622?

A deserialization vulnerability exists in the Pyfory library versions 0.12.0 to 0.12.2 and in legacy Pyfury versions 0.1.0 to 0.10.3, allowing an attacker to execute arbitrary code. The issue arises when these applications read serialized data from untrusted sources, leading to a scenario where an attacker can manipulate the data stream. This manipulation forces the system to use the insecure pickle-fallback serializer during deserialization, which can invoke the dangerous pickle.loads method, potentially leading to remote code execution. Users are advised to upgrade to Pyfory version 0.12.3 or later, which mitigates this vulnerability by removing the fallback serializer.

References