CVE-2026-38950

{"id": "CVE-2026-38950", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-38950", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-01T18:51:48.935246Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-06-01T17:16:59.257", "references": [{"url": "https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md", "source": "cve@mitre.org"}, {"url": "https://github.com/esa/AnomalyMatch/pull/9", "source": "cve@mitre.org"}, {"url": "https://imlabs.info/research/security_advisory_esa_anomaly_match_unsafe_deserialization_cve_2026_38950_ivan_markovic_052026.html", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization."}, {"lang": "es", "value": "Un problema en ESA AnomalyMatch anterior a 1.3.1 permite a los atacantes ejecutar c\u00f3digo arbitrario a trav\u00e9s de archivos de punto de control de modelo manipulados. Los componentes afectados cargan archivos de modelo de directorios de sesi\u00f3n usando torch.load() con deserializaci\u00f3n sin restricciones."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "cve@mitre.org"}