CVE-2025-71323: picklescan ctypes bypass enables

CISO Take

picklescan, a Python security scanner used to protect ML pipelines from malicious pickle files, fails to block ctypes module access in versions before 0.0.33 — allowing attackers to craft pickle files that invoke Windows syscalls via ctypes.WinDLL/kernel32.dll and execute arbitrary code while completely evading detection. The CVSS 9.8 score (no auth, no user interaction, network-reachable) is compounded by the security control bypass nature: any team relying on picklescan as their primary gate before loading serialized models or datasets has a false sense of protection against precisely the attack class the tool was deployed to prevent. With 68 prior CVEs in the same package and no EPSS data yet available, the exploitation timeline is uncertain but the low complexity and available GHSA advisory make weaponization accessible to a moderately skilled attacker. Upgrade to picklescan >= 0.0.33 immediately, audit any pickle files processed by unpatched versions, and pair the tool with safetensors format enforcement or sandboxed deserialization as defense-in-depth.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical. This is a security control bypass — organizations that deployed picklescan specifically to mitigate pickle-based RCE risks remain fully exposed on Windows systems. The ctypes and direct syscall approach bypasses both gadget chain detection and sandbox protections, meaning signature-based detection will miss malicious files that were previously scanned and trusted. The only partial mitigating factor is the Windows-specific exploit path (WinDLL/kernel32.dll); however, the underlying ctypes module bypass is platform-agnostic and the technique could be extended to Linux/macOS. ML pipelines ingesting third-party model files from public registries are the highest-risk targets.

How does the attack unfold?

Craft Malicious Pickle

Adversary creates a pickle file using ctypes.WinDLL to load kernel32.dll and invoke syscalls directly, deliberately avoiding the gadget chain patterns that picklescan monitors.

AML.T0011.000

Evade Scanner

Target organization runs picklescan on the submitted file; scanner returns clean because the ctypes module is not blocked, creating a false trusted status for the malicious artifact.

AML.T0097

Execute Payload

Trusted by the scanner result, the ML engineer or automated pipeline deserializes the pickle file, triggering the ctypes syscall chain and executing arbitrary OS commands.

AML.T0050

Full System Compromise

Adversary achieves persistent RCE on the model-loading host, enabling proprietary model theft, training data exfiltration, lateral movement to GPU clusters, or ransomware deployment.

AML.T0112

Craft Malicious Pickle

Adversary creates a pickle file using ctypes.WinDLL to load kernel32.dll and invoke syscalls directly, deliberately avoiding the gadget chain patterns that picklescan monitors.

AML.T0011.000

Evade Scanner

Target organization runs picklescan on the submitted file; scanner returns clean because the ctypes module is not blocked, creating a false trusted status for the malicious artifact.

AML.T0097

Execute Payload

Trusted by the scanner result, the ML engineer or automated pipeline deserializes the pickle file, triggering the ctypes syscall chain and executing arbitrary OS commands.

AML.T0050

Full System Compromise

Adversary achieves persistent RCE on the model-loading host, enabling proprietary model theft, training data exfiltration, lateral movement to GPU clusters, or ransomware deployment.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
420 3 dependents Pushed 9d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch: Upgrade picklescan to >= 0.0.33 immediately via pip install --upgrade picklescan.
Audit: Review any pickle files scanned by unpatched versions, especially third-party model files from public registries or untrusted contributors.
Defense in depth: Enforce safetensors or ONNX format for model serialization wherever possible to eliminate the pickle attack surface entirely.
Detection: Use fickling or manual inspection to scan pickle files for ctypes, ctypes.WinDLL, and ctypes.CDLL opcodes — these should not appear in legitimate serialized model files.
Sandbox: If pickle loading is unavoidable, execute deserialization in a strictly sandboxed container with no-new-privileges, read-only filesystem, and no network access.
Policy: Do not treat any single-scanner result as a security guarantee for untrusted model files.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Framework Model AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0097 - Virtualization/Sandbox Evasion AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.3 - Technical measures for AI system security

NIST AI RMF

MS-2.5 - Testing and verification of AI systems

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71323?

picklescan, a Python security scanner used to protect ML pipelines from malicious pickle files, fails to block ctypes module access in versions before 0.0.33 — allowing attackers to craft pickle files that invoke Windows syscalls via ctypes.WinDLL/kernel32.dll and execute arbitrary code while completely evading detection. The CVSS 9.8 score (no auth, no user interaction, network-reachable) is compounded by the security control bypass nature: any team relying on picklescan as their primary gate before loading serialized models or datasets has a false sense of protection against precisely the attack class the tool was deployed to prevent. With 68 prior CVEs in the same package and no EPSS data yet available, the exploitation timeline is uncertain but the low complexity and available GHSA advisory make weaponization accessible to a moderately skilled attacker. Upgrade to picklescan >= 0.0.33 immediately, audit any pickle files processed by unpatched versions, and pair the tool with safetensors format enforcement or sandboxed deserialization as defense-in-depth.

Is CVE-2025-71323 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71323, increasing the risk of exploitation.

How to fix CVE-2025-71323?

1. Patch: Upgrade picklescan to >= 0.0.33 immediately via `pip install --upgrade picklescan`. 2. Audit: Review any pickle files scanned by unpatched versions, especially third-party model files from public registries or untrusted contributors. 3. Defense in depth: Enforce safetensors or ONNX format for model serialization wherever possible to eliminate the pickle attack surface entirely. 4. Detection: Use fickling or manual inspection to scan pickle files for ctypes, ctypes.WinDLL, and ctypes.CDLL opcodes — these should not appear in legitimate serialized model files. 5. Sandbox: If pickle loading is unavoidable, execute deserialization in a strictly sandboxed container with no-new-privileges, read-only filesystem, and no network access. 6. Policy: Do not treat any single-scanner result as a security guarantee for untrusted model files.

What systems are affected by CVE-2025-71323?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, ML model registries, data ingestion pipelines, agent frameworks.

What is the CVSS score for CVE-2025-71323?

CVE-2025-71323 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.76%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesML model registriesdata ingestion pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0097 Virtualization/Sandbox Evasion

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.3

NIST AI RMF: MS-2.5

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.

Exploitation Scenario

An adversary targeting an ML engineering team's model ingestion workflow crafts a malicious pickle file that uses ctypes.WinDLL to load kernel32.dll and calls CreateProcess via direct syscall to establish a reverse shell. The file is uploaded to a public model hub or sent as a 'fine-tuned variant' via spearphishing. The ML engineer, following standard security procedure, runs picklescan before loading the model — the scan returns clean because ctypes is not blocked. The engineer loads the model in their training environment; pickle deserialization triggers the ctypes payload and the adversary achieves RCE on the workstation or GPU cluster. From there, they exfiltrate proprietary training data, steal fine-tuned model weights, or pivot laterally to production inference infrastructure.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.