CVE-2025-61622: PyFory Insecure Pickle Deserialization to Remote Code Execution

Original text: “CVE-2025-61622: PyFory – Insecure Pickle Deserialization to Remote Code Execution” — SecureLayer7 Blog (May 28, 2026). Code blocks, screenshots and patch diff below are reproduced verbatim with attribution captions.

Executive Summary

CVE-2025-61622 is an unauthenticated remote code execution in PyFory (formerly PyFury / Apache Fory), an open-source high-performance Python serialization framework marketed as…

https://core-jmp.org/2026/05/cve-2025-61622-pyfory-pickle-deserialization-rce/