PT-2025-44585 · Cryptidy · Cryptidy

Published 2025-10-31 · Updated 2025-11-03 · CVE-2025-63675

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cryptidy versions through 1.2.4

Description The software allows code execution due to the use of pickle.loads with untrusted data. This issue occurs within the aes decrypt message function located in the symmetric encryption.py file.

Recommendations Update cryptidy to a version later than 1.2.4.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-63675

GHSA-97W9-V595-3H5Q

Affected Products

Cryptidy

References · 13

• 🔥 https://github.com/javiermorales36/cryptidy-analysis · Exploit
• https://osv.dev/vulnerability/CVE-2025-63675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63675 · Security Note
• https://osv.dev/vulnerability/GHSA-97w9-v595-3h5q · Vendor Advisory
• https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238 · Note
• https://github.com/netinvent/cryptidy · Note
• https://twitter.com/CVEnew/status/1984166114079949201 · Twitter Post
• https://t.me/cveNotify/141079 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ol36t3/resumen_diario_de_vulnerabilidades_31102025 · Reddit Post
• https://t.me/CVEtracker/36265 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ono2et/resumen_diario_de_vulnerabilidades_03112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1onduhn/resumen_diario_de_vulnerabilidades_03112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1om1lei/resumen_diario_de_vulnerabilidades_01112025 · Reddit Post