CVE-2025-71323

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.33

Description The software fails to block the ctypes module, which is a foreign function interface library used to call C functions directly, load DLLs, and manipulate raw memory pointers. This allows attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory, bypassing sandbox protections and gadget chain detection. For example, malicious pickle files can be crafted using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands.

Recommendations Update to version 0.0.33 or later.