CVE-2025-71323
published 2026-06-17CVE-2025-71323: picklescan - Remote Code Execution via Unblocked ctypes Module picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote…
critical9.3CVSS 4.0
AVNACLATNPRNUINVCHVIHVAHSCNSINSAN
EPSS
0.76%
53.3th percentile
picklescan - Remote Code Execution via Unblocked ctypes Module
picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| picklescan | picklescan | < 0.0.33 | 0.0.33 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
picklescan up to 0.0.32 Ctypes kernel32.dll incomplete blacklist
vuldb·2026-06-17
CVE-2025-71323 [CRITICAL] picklescan up to 0.0.32 Ctypes kernel32.dll incomplete blacklist
A vulnerability was found in picklescan up to 0.0.32. It has been rated as critical. This issue affects some unknown processing in the library kernel32.dll of the component Ctypes Module. Performing a manipulation results in incomplete blacklist.
This vulnerability is reported as CVE-2025-71323. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
CVEList
picklescan - Remote Code Execution via Unblocked ctypes Module
cvelistv5·2026-06-17·CVSS 9.3
CVE-2025-71323 [CRITICAL] CWE-184 picklescan - Remote Code Execution via Unblocked ctypes Module
picklescan - Remote Code Execution via Unblocked ctypes Module
picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-17
Published