CVE-2025-10156criticalCWE-755

CVE-2025-10156: critical vulnerability in mmaitre314 picklescan

PickleScan Security Bypass via Bad CRC in ZIP Archive

Published

Follow this CVE+ Monitor picklescan+ Monitor picklescan

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.3epss 1.5%
An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
mmaitre314 · picklescan
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — mmaitre314 picklescan

In the same product, most dangerous first.

CVE-2025-1716MEDIUMpicklescan - Security scanning bypass via 'pip main'EPSS 1.7%CVE-2025-10155CRITICALPickleScan Security Bypass Using Misleading File ExtensionEPSS 0.8%CVE-2025-10157CRITICALPickleScan Bypasses Unsafe Globals Check Using Submodule ImportsEPSS 0.8%CVE-2025-1945MEDIUMpicklescan - Zip Flag Bit Exploit Crashes Picklescan But Not PyTorchEPSS 0.6%CVE-2025-1889MEDIUMpicklescan - Security scanning bypass via non-standard file extensionsEPSS 0.4%CVE-2025-1944MEDIUMpicklescan ZIP archive manipulation attack leads to crashEPSS 0.3%