CVE-2025-10156 - CVE House
Back to Database
Status published Critical CVE-2025-10156

PickleScan Security Bypass via Bad CRC in ZIP Archive

Vulnerability Description

An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-10156

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • JFrog
  • @xdcrev

References

More from mmaitre314

View All →
CVE-2025-1945
picklescan - Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
Medium 5.3
CVE-2025-1944
picklescan ZIP archive manipulation attack leads to crash
Medium 5.3
CVE-2025-1889
picklescan - Security scanning bypass via non-standard file extensions
Medium 5.3
CVE-2025-1716
picklescan - Security scanning bypass via 'pip main'
Medium 5.3
CVE-2025-10157
PickleScan Bypasses Unsafe Globals Check Using Submodule Imports
Critical 9.3

Affected Vendor

Affected Software

picklescan
Vulnerable Versions:
0

Timeline

Official Publish: September 17th, 2025
Last Modified: September 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-755

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499 Endpoint Denial of Service
Impact