CVE-2026-38950

Published: Jun 1, 2026Modified: Jul 22, 2026Deferred

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md

Source: cve@mitre.org

https://github.com/esa/AnomalyMatch/pull/9

Source: cve@mitre.org

https://imlabs.info/research/security_advisory_esa_anomaly_match_unsafe_deserialization_cve_2026_38950_ivan_markovic_052026.html

Source: cve@mitre.org

Timeline

No history available yet.