Picklescan prior to version 0.0.33 does not detect the numpy.f2py.crackfortran.getlincoef __reduce__ method in pickle objects, enabling attackers to embed and execute arbitrary Python code during deserialization. The vulnerability is a classic instance of data deserialization without validation (CWE-502) and permits code execution when a malicious pickle file is processed, compromising confidentiality, integrity, and availability. Based on the description, it is inferred that an attacker must supply a malicious pickle file containing the gadget for the exploit to succeed.

The affected product is Picklescan, developed by mmaitre314. All releases before 0.0.33 contain the flaw and are vulnerable. Users employing these versions are at risk if untrusted pickle files are loaded, particularly in shared model scenarios.

The CVSS score of 7.6 classifies this vulnerability as high severity. Exploitation requires a victim to ingest a malicious pickle file, which can occur through file ingestion or network delivery of an untrusted model artifact. Based on the description, the likely attack vector is delivering and loading a malicious pickle file that contains the vulnerable gadget. The EPSS score of < 1% indicates a very low but non-zero probability of exploitation, and the vulnerability is not listed in CISA KEV. Despite the low exploitation likelihood, the high severity and potential for supply‑chain compromise make it a significant risk.