VYPR
← All advisories
Critical severityOSV Advisory· Published Jan 16, 2019· Updated Jul 21, 2025

CVE-2019-6446

CVE-2019-6446

Description

NumPy before 1.16.3 allows arbitrary code execution via unsafe pickle deserialization in numpy.load, a disputed but exploitable behavior.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

NumPy before 1.16.3 allows arbitrary code execution via unsafe pickle deserialization in numpy.load, a disputed but exploitable behavior.

Vulnerability

An issue in NumPy before version 1.16.3 leverages the Python pickle module unsafely when deserializing objects through the numpy.load function. Starting from version 1.10.0, the allow_pickle parameter defaults to True, enabling automatic unpickling of serialized data. This allows a remote attacker to execute arbitrary code by crafting a malicious pickle object that is loaded via numpy.load. Versions 1.10.0 through 1.16.2 are affected [3][4].

Exploitation

An attacker must deliver a specially crafted pickle file to the victim, either via network download, email attachment, or other means. No authentication is required if the victim loads the malicious file directly. The attacker then triggers numpy.load on the crafted file; the pickle module deserializes the payload, executing embedded Python code. The victim does not need to explicitly set allow_pickle=True because it is the default [4].

Impact

Successful exploitation results in remote code execution in the context of the victim's Python interpreter. The attacker gains full control over confidentiality, integrity, and availability of the affected system, potentially leading to data theft, malware installation, or further compromise. This behavior is disputed by some parties who argue that loading pickled data from trusted sources is a legitimate use case; nonetheless, when an attacker can supply untrusted input, the impact is arbitrary code execution [3].

Mitigation

The vulnerability is fixed in NumPy version 1.16.3 (released 2019-03-16). Users should upgrade to this version or later. For older versions where an upgrade is not possible, set allow_pickle=False when calling numpy.load on untrusted data. Red Hat has issued updated packages (numpy-1.14.3-9.el8) that change the default to allow_pickle=False [1][2]. SUSE has also backported a similar change for affected SLE codestreams [4]. No workaround is available for the default behavior in unpatched versions.

References
  1. https://access.redhat.com/errata/RHSA-2019:3335
  2. https://access.redhat.com/errata/RHSA-2019:3704
  3. NVD - CVE-2019-6446
  4. NumPy uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
numpyPyPI
<= 1.16.0—

Affected products

56

Patches

2
89b688732b37
https://github.com/numpy/numpyvia osv
commitPR #13359
8f31f95910d2
https://github.com/numpy/numpyvia osv
commitPR #12889

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

18

News mentions

0

No linked articles in our index yet.