CVE-2025-61622

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stre...

CVE-2025-61622

CVE-2025-61622 describes a deserialization vulnerability in Apache Pyfory (and legacy PyFury) where untrusted data can trigger a pickle.loads path during deserialization, enabling remote code execution. Affected: Pyfory versions 0.12.0–0.12.2 and legacy PyFury 0.1.0–0.10.3. The issue arises from ...