CVE-2025-61622 Details
Description
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution. Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.
A critical vulnerability exists in the Apache Fory Python packages pyfory (versions 0.12.0 to 0.12.2) and pyfury (the new name introduced in version 0.12.0, also covering versions 0.12.0 to 0.12.2). This vulnerability arises from the deserialization of untrusted data, allowing for arbitrary code execution. Applications that read pyfory serialized data from untrusted sources are at risk. An attacker can exploit this by crafting a data stream that triggers the pickle-fallback serializer during deserialization, which then executes 'pickle.loads'. The use of 'pickle.loads' is particularly dangerous as it is vulnerable to remote code execution.
Users are advised to upgrade to Apache Fory version 0.12.3 or later, which removes the pickle fallback serializer and addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2025/09/29/3 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd | [email protected] | Issue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache fory | >= 0.1.0, <= 0.10.3 >= 0.12.0, <= 0.12.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Nov 4, 2025 | CVE Modified | CVE |
| Oct 1, 2025 | CVE Modified | CISA-ADP |
| Oct 1, 2025 | New CVE Received | [email protected] |