picklescan before version 0.0.33 does not block the ctypes module, which allows an attacker to craft a malicious pickle file that uses ctypes.WinDLL to load kernel32.dll and invoke direct system calls. This flaw enables the execution of arbitrary commands and bypasses any sandbox or gadget chain detection provided by the application.

The vulnerability affects the picklescan tool developed by mmaitre314. All releases before 0.0.33 are vulnerable; versions starting with 0.0.33 and later include the protection that blocks the ctypes module.

The CVSS score of 9.3 classifies the flaw as critical, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers likely exploit this flaw by delivering a malicious pickle payload to an application that loads picklescan and deserializes untrusted data, causing remote code execution from the attacker's side.