Xorbits Xoscar EUVD-2026-100500

Exploitation requires network reachability to the Xoscar actor-pool TCP channel (the inter-process/inter-node communication port used by SocketChannel). No authentication, user interaction, or special feature flag is required - the flaw sits in the default message-receive path where SocketChannel.recv() passes raw bytes to cloudpickle.loads() prior to message-type validation, so any deployment running an actor pool on a reachable interface is exposed against default configurations of Xorbits Xoscar (0.1.0 through 0.11.2). Practical LIMITING factors: the actor-pool port must be reachable by the attacker (deployments that bind only to localhost or isolate the actor-pool network segment are not remotely exploitable), and impact severity depends on the privilege of the server process - the worst case (root) applies specifically to GPU-node deployments that run the process as root.

All available signals point to a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, base 9.3) describes a remote, low-complexity, unauthenticated path to full compromise, and the mechanism (CWE-502 deserialization of attacker-controlled data via cloudpickle.loads() before any message-type validation) is a well-understood, reliable RCE primitive that typically does not require exotic conditions. The description's note that the server process 'commonly runs as root on GPU nodes' amplifies impact beyond the base score's unchanged scope, since successful exploitation often yields root on high-value ML infrastructure. Countervailing signals that LOWER practical urgency: this is NOT in CISA KEV (no confirmed active exploitation), no EPSS probability was provided, and no public proof-of-concept is referenced - only a VulnCheck advisory and the vendor source lines. The CVSS vector and the description are consistent (both support remote unauthenticated code execution), so there is no network-vs-local contradiction to flag. Net: treat as a serious, prioritize-the-patch vulnerability for anyone running Xoscar actor pools on reachable networks, while recognizing that exploitation is currently theoretical/advisory-driven rather than observed in the wild.

An attacker with network reachability to an exposed Xoscar actor-pool TCP port sends a crafted serialized payload; SocketChannel.recv() hands the bytes to cloudpickle.loads() before validating the message type, triggering a malicious pickle __reduce__ gadget that runs attacker code. Because the actor-pool process frequently runs as root on GPU nodes, this yields root-level remote code execution. No public exploit is referenced, but the attack is low-complexity and unauthenticated.