{"id":"CVE-2025-71463","aliases":["DEBIAN-CVE-2025-71463","EUVD-2025-211318","GHSA-cq46-m9x9-j8w2","GHSA-f572-w3j5-2qmc","UBUNTU-CVE-2025-71463"],"status":"published","title":"Scapy before 2.7.0 Insecure Deserialization RCE via Session Files","description":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00242,"percentile":0.15484,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2025-10-22T16:45:49Z","modified":"2026-11-14T15:00:07Z","fixes":[{"ecosystem":"Debian:14","package":"scapy","fixed_in":["2.7.0+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0+dfsg-2","2.5.0+git20240324.2b58b51+dfsg-1","2.5.0+git20240324.2b58b51+dfsg-2","2.6.0+dfsg-1","2.6.0+dfsg-2","2.6.1+dfsg-1","2.6.1+dfsg-2","2.6.1+dfsg-3","2.7.0+dfsg-1","2.7.0+dfsg1-1","2.8.0+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1+dfsg-1","2.6.1+dfsg-2","2.6.1+dfsg-3","2.7.0+dfsg-1","2.7.0+dfsg1-1","2.8.0+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0+dfsg1-1"}]}],"versions":["2.6.1+dfsg-1","2.6.1+dfsg-2","2.6.1+dfsg-3","2.7.0+dfsg-1"]},{"source":"osv","ecosystem":"PyPI","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.1"}]}],"versions":["2.2.0-dev","2.3.1","2.3.2","2.3.3","2.4.0","2.4.0rc3","2.4.0rc4","2.4.0rc5","2.4.1","2.4.2","2.4.3","2.4.3rc1","2.4.3rc2","2.4.3rc3","2.4.3rc4","2.4.4","2.4.4rc1","2.4.4rc2","2.4.5","2.4.5rc1","2.4rc2","2.5.0","2.5.0rc1","2.5.0rc2","2.5.0rc3","2.6.0","2.6.0rc1","2.6.0rc2","2.6.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.3-1","2.3.3-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-1","2.4.3-3","2.4.3-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0+dfsg-2","2.5.0+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"scapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1+dfsg-1","2.6.1+dfsg-3","2.7.0+dfsg-1","2.7.0+dfsg1-1"]}],"products":[{"vendor":"secdev","product":"scapy"}],"references":[{"url":"https://github.com/secdev/scapy/security/advisories/GHSA-cq46-m9x9-j8w2","tags":["vendor-advisory","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/scapy-before-2.7.0-insecure-deserialization-rce-via-session-files","tags":["third-party-advisory","advisory","report"]},{"url":"https://github.com/secdev/scapy/commit/13621d1145b3435e9d03caf20997107a84435c0b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cq46-m9x9-j8w2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71463","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f572-w3j5-2qmc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71463.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-71463","tags":["advisory"]},{"url":"https://github.com/secdev/scapy","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-71463","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-71463","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-71463","title":"Scapy before 2.7.0 Insecure Deserialization RCE via Session Files","description":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().","status":"published","published":"2026-11-13T09:36:59.897Z","modified":"2026-11-13T20:35:14.393Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-13T10:27:12.184616Z"}],"euvd":[{"id":"EUVD-2025-211318","description":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().","status":"published","published":"2026-11-13T09:36:59Z","modified":"2026-11-13T20:35:14Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-13T14:38:51.246778Z"}],"ghsa":[{"id":"GHSA-cq46-m9x9-j8w2","title":"Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization","description":"### Summary\n\nAn unsafe deserialization vulnerability in Scapy \u003cv2.7.0 allows attackers to execute arbitrary code **when a malicious session file is locally loaded via the `-s` option**. This requires convincing a user to manually load a malicious session file.\n\n---\n\n### Details\n\nScapy’s interactive shell supports session loading using gzip-compressed pickle files:\n\n```bash\n./run_scapy -s \u003csession_file.pkl.gz\u003e\n```\n\nInternally, this triggers:\n\n```python\n# main.py\nSESSION = pickle.load(gzip.open(session_name, \"rb\"))\n```\n\nSince no validation or restriction is performed on the deserialized object, **any code embedded via `__reduce__()` will be executed immediately**. This makes it trivial for an attacker to drop a malicious `.pkl.gz` in a shared folder and have it executed by unsuspecting users.\n\nThe vulnerability exists in the `load_session` function, which deserializes data using `pickle.load()` on `.pkl.gz` files provided via the `-s` CLI flag or programmatically through `conf.session`.\n\n**Affected lines in source code**:\nhttps://github.com/secdev/scapy/blob/master/scapy/main.py#L569-L572\n\n```python\ntry:\n    s = pickle.load(gzip.open(fname, \"rb\"))\nexcept IOError:\n    try:\n        s = pickle.load(open(fname, \"rb\"))\n```\n\n### Impact\n\nThis is a classic deserialization vulnerability which leads to Code Execution (CE) when untrusted data is deserialized.\n\nAny user who can trick another user into loading a crafted `.pkl.gz` session file (e.g. via `-s` option) can execute arbitrary Python code.\n\n- **Vulnerability type:** Insecure deserialization (Python `pickle`)\n- **CWE**: [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)\n- **CVSS v4.0 Vector**: `CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`\n- **CVSS Score**: 5.4 (Medium)\n- **Impact:** Arbitrary Code Execution\n- **Attack vector:** Local or supply chain (malicious `.pkl.gz`)\n- **Affected users:** Any user who loads session files (even interactively)\n- **Affected version:** **Scapy v2.6.1**\n\n---\n\n### Mitigations\n\n- Do not use 'sessions' (the -s option when launching Scapy).\n- Use the Scapy 2.7.0+ where the session mechanism has been removed.","status":"published","published":"2025-10-22T16:45:49Z","modified":"2025-10-23T20:10:45Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:03.380616Z"},{"id":"GHSA-f572-w3j5-2qmc","title":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session...","description":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().","status":"published","published":"2026-11-13T12:31:12Z","modified":"2026-11-13T12:31:17Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-13T12:50:12.078093Z"}],"nvd":[{"id":"CVE-2025-71463","description":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().","status":"published","published":"2026-11-13T10:17:24.403Z","modified":"2026-11-13T23:10:00.153Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-13T23:38:07.871162Z"}],"osv":[{"id":"CVE-2025-71463","title":"Scapy before 2.7.0 Insecure Deserialization RCE via Session Files","description":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().","status":"published","published":"2026-11-13T09:36:59.897Z","modified":"2026-11-14T10:30:23.327852107Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-14T03:11:37.908985Z"},{"id":"DEBIAN-CVE-2025-71463","description":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().","status":"published","published":"2026-11-13T10:17:24.403Z","modified":"2026-11-14T15:00:07.396757022Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-14T15:04:35.718414Z"},{"id":"GHSA-cq46-m9x9-j8w2","title":"Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization","description":"### Summary\n\nAn unsafe deserialization vulnerability in Scapy \u003cv2.7.0 allows attackers to execute arbitrary code **when a malicious session file is locally loaded via the `-s` option**. This requires convincing a user to manually load a malicious session file.\n\n---\n\n### Details\n\nScapy’s interactive shell supports session loading using gzip-compressed pickle files:\n\n```bash\n./run_scapy -s \u003csession_file.pkl.gz\u003e\n```\n\nInternally, this triggers:\n\n```python\n# main.py\nSESSION = pickle.load(gzip.open(session_name, \"rb\"))\n```\n\nSince no validation or restriction is performed on the deserialized object, **any code embedded via `__reduce__()` will be executed immediately**. This makes it trivial for an attacker to drop a malicious `.pkl.gz` in a shared folder and have it executed by unsuspecting users.\n\nThe vulnerability exists in the `load_session` function, which deserializes data using `pickle.load()` on `.pkl.gz` files provided via the `-s` CLI flag or programmatically through `conf.session`.\n\n**Affected lines in source code**:\nhttps://github.com/secdev/scapy/blob/master/scapy/main.py#L569-L572\n\n```python\ntry:\n    s = pickle.load(gzip.open(fname, \"rb\"))\nexcept IOError:\n    try:\n        s = pickle.load(open(fname, \"rb\"))\n```\n\n### Impact\n\nThis is a classic deserialization vulnerability which leads to Code Execution (CE) when untrusted data is deserialized.\n\nAny user who can trick another user into loading a crafted `.pkl.gz` session file (e.g. via `-s` option) can execute arbitrary Python code.\n\n- **Vulnerability type:** Insecure deserialization (Python `pickle`)\n- **CWE**: [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)\n- **CVSS v4.0 Vector**: `CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`\n- **CVSS Score**: 5.4 (Medium)\n- **Impact:** Arbitrary Code Execution\n- **Attack vector:** Local or supply chain (malicious `.pkl.gz`)\n- **Affected users:** Any user who loads session files (even interactively)\n- **Affected version:** **Scapy v2.6.1**\n\n---\n\n### Mitigations\n\n- Do not use 'sessions' (the -s option when launching Scapy).\n- Use the Scapy 2.7.0+ where the session mechanism has been removed.","status":"published","published":"2025-10-22T16:45:49Z","modified":"2026-11-14T02:56:23.704759586Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-14T03:11:06.681237Z"},{"id":"UBUNTU-CVE-2025-71463","description":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().","status":"published","published":"2026-11-13T00:00:00Z","modified":"2026-11-13T21:03:05.134537444Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"},{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-13T21:30:18.594651Z"}]}}