CVE-2025-71463

Name of the Vulnerable Software and Affected Versions Scapy versions prior to 2.7.0

Description An insecure deserialization issue exists in the load session() function. An attacker can execute arbitrary Python code by tricking a user into loading a specially crafted .pkl.gz pickle session file via the -s option or conf.session variable. The execution occurs through the reduce () method during the deserialization process.

Recommendations Update Scapy to version 2.7.0 or later. As a temporary mitigation, avoid loading untrusted session files using the -s option or conf.session variable.