Deserialization Vulnerability in Pyfory and Legacy Pyfury Software
CVE-2025-61622

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Fory
Vendor
CVE Published:
1 October 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-61622?

A deserialization vulnerability exists in the Pyfory library versions 0.12.0 to 0.12.2 and in legacy Pyfury versions 0.1.0 to 0.10.3, allowing an attacker to execute arbitrary code. The issue arises when these applications read serialized data from untrusted sources, leading to a scenario where an attacker can manipulate the data stream. This manipulation forces the system to use the insecure pickle-fallback serializer during deserialization, which can invoke the dangerous pickle.loads method, potentially leading to remote code execution. Users are advised to upgrade to Pyfory version 0.12.3 or later, which mitigates this vulnerability by removing the fallback serializer.

Affected Version(s)

Apache Fory 0.12.0 <= 0.12.2

Apache Fory 0.1.0 <= 0.10.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve_2025_61622_poc
Created by fa1consec

References

https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mapta / BugBunny_ai
JSON
.