Critical RCE Flaw in Apache Fory’s Python Module (CVE-2025-61622)

A critical remote code execution vulnerability has been disclosed in Apache Fory’s Python module pyfory (CVE-2025-61622), affecting Apache Fory versions 0.5.0 to 0.12.2. According to the advisory, deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2 allows arbitrary code execution.

The flaw stems from an unguarded pickle fallback serializer, which can be abused if an application processes untrusted serialized data, enabling a data stream to force the library to use the vulnerable fallback. Attackers can craft a data stream that selects the pickle-fallback serializer during deserialization, leading to the execution of pickle[.]loads and remote code execution. The Apache Fory team urges users to upgrade to version 0.12.3 or later, which removes the pickle fallback serializer to fix the issue.