CVE-2025-71463
MEDIUM
NVD
CVSS Score
6.7
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().