Apache Pyfory versions 0.12.0 through 0.12.2 and legacy Pyfury versions 0.1.0 through 0.10.3 are vulnerable to deserialization of untrusted data. This vulnerability allows an attacker to execute arbitrary code by crafting a malicious data stream that triggers the pickle fallback serializer during deserialization. The issue is fixed in Pyfory version 0.12.3, which removes the pickle fallback serializer.