CVE-2025-61622

CVE-2025-61622 is a deserialization of untrusted data flaw (CWE-502) in the Python implementation of Apache Fory, a high-performance serialization framework. It is triggered whenever an application deserializes pyfory/pyfury data received from an untrusted source: an attacker crafts a data stream that forces the pickle-fallback serializer to be selected, causing the library to invoke vulnerable `pickle.loads` on attacker-controlled input. Successful exploitation results in arbitrary code execution in the context of the application process, with the critical CVSS 9.8 score reflecting network exploitation with no privileges or user interaction required. Affected users are applications running pyfory 0.12.0 through 0.12.2, or the legacy pyfury package 0.1.0 through 0.10.3, that consume pyfory-serialized data from untrusted sources. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a high 43.5% probability of exploitation within 30 days.

What to do: Upgrade to pyfory 0.12.3 or later, which removes the pickle-fallback serializer and fixes the issue; legacy pyfury (0.1.0-0.10.3) users should migrate to pyfory 0.12.3+. Audit your environment for Python applications that deserialize pyfory/pyfury payloads from untrusted sources (network inputs, message queues, files) and treat those as exposed. If immediate upgrade is not possible, restrict deserialization to trusted peer endpoints that cannot supply attacker-controlled data.