This vulnerability exists in the pickle protocol implementation of Pyro v3.x. An attacker can craft a malicious pickled string message that, when deserialized by the vulnerable Pyro service, leads to arbitrary code execution. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, with complete impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-94 (Improper Control of Generation of Code). No patch or official remediation level has been disclosed yet.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems running Pyro v3.x, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the impacted system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid deserializing untrusted pickle data in Pyro v3.x environments. Implement network-level controls to restrict access to Pyro services from untrusted sources.