CVE-2025-10156: Mmaitre314 Picklescan RCE Vulnerability

CVE-2025-10156 Overview

An Improper Handling of Exceptional Conditions vulnerability exists in the ZIP archive scanning component of mmaitre314 picklescan that allows remote attackers to bypass security scans. The flaw enables attackers to craft malicious ZIP archives containing files with bad Cyclic Redundancy Check (CRC) values, causing the scanner to halt prematurely and fail to analyze archive contents for malicious pickle files. When the file incorrectly considered safe is subsequently loaded, it can lead to arbitrary code execution.

This vulnerability is particularly concerning in machine learning (ML) and artificial intelligence (AI) workflows where pickle files are commonly used for model serialization. The picklescan tool is designed to detect malicious code in pickle files before they are loaded, making this bypass a significant security concern for ML pipelines and model repositories.

Critical Impact

Remote attackers can bypass picklescan security analysis by crafting ZIP archives with bad CRC values, enabling undetected delivery of malicious pickle files that execute arbitrary code when loaded.

Affected Products

• mmaitre314 picklescan (all versions prior to patch)

Discovery Timeline

• September 17, 2025 - CVE-2025-10156 published to NVD
• October 02, 2025 - Last updated in NVD database

Technical Details for CVE-2025-10156

Vulnerability Analysis

The vulnerability resides in picklescan's ZIP archive handling logic, specifically in how the tool processes CRC validation failures during archive extraction. When picklescan encounters a file within a ZIP archive that has a corrupted or intentionally malformed CRC value, the scanner fails to gracefully handle this exceptional condition. Instead of continuing to scan remaining files or flagging the archive as potentially dangerous, the tool halts execution entirely.

This improper exception handling creates a critical security gap. An attacker can embed a malicious pickle file within a ZIP archive alongside a decoy file that has been deliberately crafted with an invalid CRC checksum. When picklescan attempts to process the archive, it encounters the bad CRC and stops scanning, never reaching the malicious pickle file. The archive is then incorrectly reported as safe or the scan terminates without proper completion.

The attack vector is network-based, requiring no privileges or user interaction, making it highly exploitable in automated ML pipelines where model files are downloaded and processed without manual intervention.

Root Cause

The root cause is improper handling of exceptional conditions (CWE-755) in the ZIP file processing component. The relaxed_zipfile.py module fails to implement proper error recovery when CRC validation fails during archive decompression. Rather than catching the exception and continuing to process remaining archive entries, the scanner terminates or reports incomplete results, allowing malicious content to evade detection.

Attack Vector

The attack exploits the network-accessible nature of ML model distribution through repositories like Hugging Face. An attacker could upload a specially crafted ZIP or model archive containing:

1. A benign-looking file with an intentionally corrupted CRC value positioned early in the archive
2. A malicious pickle file containing arbitrary code execution payload

When the target system downloads and scans this archive using picklescan, the scanner encounters the bad CRC, halts processing, and fails to detect the malicious pickle file. The victim then loads the "scanned" model file, triggering code execution.

The attack is particularly effective against:

• Automated CI/CD pipelines that scan models before deployment
• ML frameworks that integrate picklescan as a security gate
• Model repositories and registries performing security validation

Detection Methods for CVE-2025-10156

Indicators of Compromise

• ZIP archives containing files with deliberately corrupted CRC checksums
• Picklescan processes terminating unexpectedly during archive scanning
• Incomplete scan reports or missing analysis results for archive contents
• Error logs indicating CRC validation failures during model file processing
• Downloaded model files that trigger exceptions in standard ZIP libraries

Detection Strategies

• Monitor picklescan execution for premature termination or incomplete scans
• Implement secondary validation of ZIP archives using standard library CRC checks before trusting picklescan results
• Alert on any ZIP extraction errors or CRC failures in ML pipeline security scanning
• Compare expected archive contents against actually scanned file counts to detect incomplete processing

Monitoring Recommendations

• Log and alert on all picklescan exceptions and error conditions
• Monitor model download sources for newly uploaded archives with unusual characteristics
• Implement network traffic analysis for suspicious model file downloads from external repositories
• Track pickle file loading operations and correlate with preceding scan results

How to Mitigate CVE-2025-10156

Immediate Actions Required

• Review and update picklescan to the latest patched version addressing this vulnerability
• Audit all recently scanned archives that may have triggered CRC errors during processing
• Implement additional validation layers for model files before loading
• Quarantine any model files that were scanned during the vulnerable period and re-scan after patching

Patch Information

The vendor has published a security advisory addressing this vulnerability. Users should consult the GitHub Security Advisory for specific patch version information and upgrade instructions. The fix involves implementing proper exception handling in the relaxed_zipfile.py module to ensure all archive entries are processed regardless of individual file CRC validation failures.

Workarounds

• Pre-validate ZIP archives using standard libraries to detect bad CRC values before passing to picklescan
• Reject any archives that fail CRC validation rather than relying solely on picklescan results
• Implement archive content enumeration to verify all expected files were actually scanned
• Use isolated sandbox environments for loading any pickle files from external sources
• Consider alternative serialization formats like SafeTensors that do not execute arbitrary code

# Configuration example - Pre-validate ZIP archives before scanning
# Check for CRC errors using unzip before running picklescan
unzip -t model_archive.zip || { echo "CRC validation failed - archive rejected"; exit 1; }

# Only proceed with picklescan if CRC validation passes
picklescan -p model_archive.zip