The vulnerability identified as CVE-2025-71366 affects picklescan versions prior to 0.0.28. The tool fails to detect malicious calls to the function torch.utils.bottleneck.__main__.run_cprofile within pickle files. This failure allows remote attackers to embed code that bypasses the safety mechanisms of picklescan, resulting in arbitrary code execution upon loading the crafted pickle files. The issue is categorized under CWE-502, which relates to deserialization of untrusted data.

An attacker can craft malicious pickle files containing undetected function calls that bypass picklescan's safety checks. When such files are loaded by a victim, arbitrary code execution can occur, potentially compromising the victim's system. This represents a significant security risk, especially in environments where pickle files are received from untrusted sources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to picklescan version 0.0.28 or later once available, as this version addresses the detection failure. Until a fix is confirmed, avoid loading pickle files from untrusted sources to mitigate risk.