Parsing Logic Error in Picklescan Leading to Security Bypass

CVE-2025-71325

What is CVE-2025-71325?

The affected versions of Picklescan feature a critical parsing logic error within the _list_globals function, specifically when processing STACK_GLOBAL opcodes. This flaw inadvertently fails to properly track arguments within designated ranges, enabling attackers to exploit this vulnerability by crafting malicious pickle files that utilize position zero arguments. Consequently, this may lead to unexpected exceptions, effectively allowing these files to evade the security scanning mechanisms designed to protect users from harmful content.

References