PT-2025-39961 · Apache · Apache Fory

Bugbunny_Ai · Published 2025-09-30 · Updated 2026-06-29 · CVE-2025-61622

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyfory versions 0.12.0 through 0.12.2 pyfury versions 0.1.0 through 0.10.3

Description Deserialization of untrusted data in Python allows arbitrary code execution. An application is susceptible if it reads serialized data from untrusted sources. An attacker can craft a data stream that triggers the pickle-fallback serializer during deserialization, resulting in the execution of the pickle.loads() function, which enables remote code execution.

Recommendations Upgrade pyfory versions 0.12.0 through 0.12.2 to version 0.12.3 or later. Upgrade pyfury versions 0.1.0 through 0.10.3 to pyfory version 0.12.3 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-61622

GHSA-538V-3WQ9-4H3R

PYSEC-2026-490

PYSEC-2026-491

Affected Products

Apache Fory

References · 39

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61622.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61622 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61622 · Vendor Advisory
• https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-538v-3wq9-4h3r · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-491 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-490 · Vendor Advisory
• https://github.com/apache/fory · Note
• https://github.com/apache/fory/pull/2629 · Note
• https://github.com/apache/fory/releases/tag/v0.12.3 · Note
• https://github.com/apache/fory/commit/379b948ecae5c3b849e5bdb3997978c9a163e40b · Note
• https://pypi.org/project/pyfory · Note
• https://reddit.com/r/VibeCodeDevs/comments/1ohginc/securing_vibecoded_apps · Reddit Post
• https://reddit.com/r/bugbounty/comments/1oejfmo/autonomous_ai_pentests · Reddit Post
• https://twitter.com/CVEnew/status/1973331207694786793 · Twitter Post