Security readout for executives and security teams
Plain-English summary
CVE-2025-71325 is a flaw in picklescan, a tool used to inspect Python pickle files for unsafe content. Versions before 0.0.27 can miss malicious pickle content because of incorrect parsing of STACK_GLOBAL opcodes. The business risk is strongest where picklescan is trusted as a security gate before accepting or loading model or data files.
Executive priority
Prioritize remediation if your organization handles third-party pickle or ML model files. This is a supply-chain and file-ingestion control weakness: the scanner may say a file is safe when it is not. If picklescan is not used, direct exposure is unlikely.
Technical view
The issue is a parsing logic error in picklescan’s _list_globals handling of STACK_GLOBAL opcodes. Crafted pickle files can place arguments at position zero, causing unexpected exceptions and evading detection. Public sources identify a patch commit and describe versions before 0.0.27 as affected. CWE-391 is cited.
Likely exposure
Exposure is likely in Python or ML workflows that scan untrusted pickle files with picklescan before use. Risk is lower where pickle files are not accepted from external sources or where additional controls prevent unsafe deserialization.
Exploitation context
The supplied sources describe a detection bypass, not confirmed active exploitation. KEV is false in the provided data. The practical concern is that malicious pickle files may pass scanning and later harm systems if loaded by downstream tools.
Researcher notes
Evidence is limited to the CVE bundle, GHSA, patch commit, and VulnCheck advisory. The issue is a bypass in detection logic, so impact depends on downstream deserialization behavior. Do not assume remote compromise unless the vulnerable scanner protects a path that later loads attacker-controlled pickle files.
Mitigation direction
- Upgrade picklescan to version 0.0.27 or later if vendor guidance confirms availability.
- Review pipelines that rely on picklescan as the only control for pickle safety.
- Avoid loading untrusted pickle files unless strong isolation and validation controls are in place.
- Monitor the GHSA and project repository for updated guidance.
Validation and detection
- Inventory environments and CI pipelines using picklescan.
- Confirm installed picklescan versions are not older than 0.0.27.
- Check whether pickle files from users, partners, or public sources are scanned and then loaded.
- Review security logs for prior scanner exceptions or failed pickle analysis results.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-391: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-71325 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GHSA Advisory GHSA-9gvj-pp9x-gcfrCVE reference, VulnCheck · vendor-advisory
- https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0fCVE reference, VulnCheck · patch
- VulnCheck Advisory: picklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic FlawCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.