MosaicML Composer EUVD-2026-39110

Exploitation requires the victim to load an attacker-controlled checkpoint file through Composer's checkpoint loading path - specifically the resumption checkpoint loader (load_resumption_checkpoint, which used pickle.load) or the general torch.load path that used weights_only=False. The concrete prerequisite is that the target opens/loads a malicious checkpoint or .pt file (UI:R), e.g. one obtained from an untrusted model hub, shared drive, or collaborator. Limiting factors: there is no remote network-listening service to attack (AV:L) - the attacker must get the victim to load the file; no authentication or special privileges are needed on the victim side (PR:N); and exploitation is confined to organizations that load externally sourced checkpoints, so deployments that only load self-produced, trusted checkpoints are not realistically exposed. No special non-default configuration is required - the unsafe deserialization was the default behavior on the affected code path.

The CVSS 3.0 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local attack vector, low complexity, no privileges, but requiring user interaction, with full confidentiality/integrity/availability impact at unchanged scope. This is a client-side/processing vulnerability, not a remotely reachable network service: the 'remote attacker' delivers a poisoned checkpoint that a victim must load, which reconciles the description's 'Remote Code Execution' wording with the AV:L vector (local execution triggered by opening attacker-supplied content). No EPSS score, KEV listing, or SSVC decision was provided in the input, so exploitation probability cannot be quantified; however, the pattern (unsafe pickle in an ML library) is well understood and trivially weaponizable, as the vendor's own regression test demonstrates with an os.system payload. Real-world priority is moderate and contingent on whether an organization loads third-party/untrusted checkpoints - environments that only load self-generated checkpoints face limited exposure.

An attacker publishes a backdoored model checkpoint on a public model hub or sends it to an ML engineer as 'pretrained weights' or a 'resume training' file. When the victim calls Composer's checkpoint loading on that file, the embedded pickle payload (e.g. an object whose __reduce__ returns os.system('...')) executes attacker code with the privileges of the training process. No exploit code is public, but the vendor's own regression test shows how trivially a malicious __reduce__ payload triggers execution, reflecting low attack complexity (AC:L) offset by required user interaction (UI:R).