What is the CVSS score of CVE-2026-14534?

CVE-2026-14534 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of fickling are affected by CVE-2026-14534?

Trail of Bits fickling (versions ≤0.1.10) contains a logic flaw in its pickle deserialization safety validation that allows attackers to execute arbitrary code while bypassing the library's security…. A patch is available.

How to fix or mitigate CVE-2026-14534?

Within 24 hours: Inventory all systems running fickling ≤0.1.10 and identify which use cases process untrusted pickle sources; prioritize discontinuation or isolation of such systems. Within 7 days: Implement compensating controls (see below) and establish vendor communication regarding patch timeline. Within 30 days: Plan and test upgrade path once patch becomes available, or migrate to alternative serialization formats.

fickling CVE-2026-14534

EUVD-2026-41675 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-07-04 BombadilSystems

GHSA-v8cr-9jrc-fwf9

RCE Python Fickling Trailofbits

8.8

CVSS 3.1 · Vendor: BombadilSystems

Severity by source

Vendor (BombadilSystems) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Attacker-supplied pickle is network-deliverable (AV:N) and needs no auth (PR:N), but a victim must run the scanner/loader on it (UI:R); a successful bypass yields full RCE (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (BombadilSystems).

CVSS VectorVendor: BombadilSystems

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 14:17 vuln.today

DescriptionCVE.org

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling's check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern.

AnalysisAI

Arbitrary code execution bypass in Trail of Bits fickling (versions ≤ 0.1.10) allows attackers to craft malicious pickle files that the tool's check_safety() gate rates LIKELY_SAFE with zero findings. Because the standard-library modules _posixsubprocess, site, and atexit are missing from the UNSAFE_IMPORTS denylist in fickle.py, payloads invoking _posixsubprocess.fork_exec, site.execsitecustomize, or atexit._run_exitfuncs pass the scanner and are then deserialized and executed by fickling.load(), which chains check_safety() into pickle.loads() as its security gate. No public exploit has been identified at time of analysis, and no EPSS or KEV signals are present in the input, but the advisory documents the exact bypass primitives.

Technical ContextAI

fickling is a Python pickle security-analysis and safe-loading library that inspects pickle bytecode and classifies payloads (SAFE / LIKELY_SAFE / LIKELY_UNSAFE) before optionally deserializing them. Its defense is a denylist model - UNSAFE_IMPORTS in fickle.py enumerates dangerous importable modules that the UnsafeImports heuristic flags. The root cause is CWE-184 (Incomplete List of Disallowed Inputs): three exploitable stdlib modules were never added to the denylist, so _posixsubprocess.fork_exec (a C-level process spawner that executes arbitrary binaries), site.execsitecustomize (runs arbitrary site-customization code), and atexit._run_exitfuncs (fires registered exit handlers) are treated as benign. Complementary heuristics also fail to compensate: OvertlyBadEvals ignores them because they are stdlib imports, UnsafeImports ignores them because they are absent from the denylist, and the UnusedVariables heuristic is defeated by the SETITEMS opcode pattern. The affected package is identified by cpe:2.3:a:trailofbits:fickling:*:*:*:*:*:*:*:*, and the advisory notes the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types), indicating a recurring denylist-completeness weakness in this tool.

RemediationAI

Vendor-released patch: upgrade fickling to v0.1.11 or later (https://github.com/trailofbits/fickling/releases/tag/v0.1.11), which adds the missing modules to the denylist per PR https://github.com/trailofbits/fickling/pull/272 and commit e8408615b63adf034f891f653692ab9b51f0f5af; review the advisory at https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697. If immediate upgrade is not possible, do not treat a LIKELY_SAFE verdict from vulnerable versions as authoritative for untrusted pickles - route all untrusted model files through isolation (deserialize only inside a sandboxed, network-restricted, least-privileged container or ephemeral VM) so a missed detection cannot spawn processes on a trusted host, accepting the operational overhead of sandbox provisioning. As a stopgap you may extend the local UNSAFE_IMPORTS denylist to include _posixsubprocess, site, and atexit, but this is fragile because the same class of gap has recurred (cProfile, pty, marshal/types) and hand-maintained denylists are inherently incomplete; prefer the upstream fix.