Checkpoint
Monthly
Arbitrary Python code execution in docTR through 1.1.0 is possible when load_pretrained_params() deserializes an attacker-controlled or tamperable checkpoint on PyTorch releases before 2.6. Unauthenticated attackers can supply the poisoned model artifact, but exploitation is conditionally gated: the victim application must load that checkpoint from a path or URL the attacker controls, and PyTorch must predate 2.6, where torch.load began defaulting to weights_only=True. No public exploit code or CISA KEV entry was identified at time of analysis, and this is a genuine but conditionally-gated code-execution flaw rather than a drop-everything emergency.
Authorization bypass in IntentKit through 2.6.3 allows unauthenticated callers to execute owner-only, state-changing tools - wallet transfers, social posting, memory writes, and agent-to-agent calls - on agents reachable through WEB, API, Twitter, or Telegram contexts. The executor authorizes each tool call against the complete tool registry instead of the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, so an attacker who knows the exact de-advertised tool name and supplies valid arguments can drive it via indirect prompt injection or by replaying checkpoint and history data on a reused thread, with no human-in-the-loop or approval gate intervening (CWE-862, missing authorization). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; risk is driven by the fully remote, unauthenticated, low-complexity vector with high integrity impact (CVSS 4.0 base 8.7), and exploitation still requires knowledge of the specific restricted tool names plus a working injection or replay channel against an agent that actually has those tools registered.
Unsafe deserialization in NVIDIA Megatron-LM's checkpoint-loading routine allows an attacker to execute arbitrary code, escalate privileges, disclose information, and tamper with data by convincing a user to load a maliciously crafted checkpoint or model file into the framework. The flaw is rated CVSS 7.8 (High) and is reachable only when a victim actually opens an attacker-supplied checkpoint, so organizations that load checkpoints exclusively from trusted internal sources are not realistically exposed; the vulnerable path is local (AV:L) and depends on user interaction per our assessment, with no network service or authentication bypass involved. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV, though the availability of proof-of-concept tooling for pickle-based deserialization attacks in ML frameworks makes this class of issue practically exploitable once a crafted checkpoint is delivered.
Deserialization of untrusted data in the NVIDIA Megatron-LM checkpoint-loading path allows code execution, privilege escalation, information disclosure, and data tampering when a user is convinced to load a maliciously crafted checkpoint file. NVIDIA PSIRT scores this CVSS 7.8 (High) and both the vendor and the independent assessment agree on full confidentiality, integrity, and availability impact; the assessments differ on prerequisites, with the vendor vector indicating low privileges and no user interaction (PR:L/UI:N) while the independent assessment models it as no privileges with required victim interaction (PR:N/UI:R). No public exploit code or CISA KEV entry was identified at time of analysis, and only environments that actually load untrusted checkpoints are exposed; code runs with the privileges of the loading user or process, not inherently as root.
Privilege escalation in containerd's CRI checkpoint-restore path allows an authenticated local attacker who can submit an attacker-controlled checkpoint archive via CRI CreateContainer to have the restored process run with restored credentials (including root), full capabilities, and restored no_new_privs and seccomp state, while CRI status continues to report the requested ContainerConfig. The flaw affects containerd 2.1.0 through 2.2.6 and 2.3.0 through 2.3.3, and only where CRI checkpoint restore via CreateContainer is actually used; systems that never use this experimental feature are not affected. Rated CVSS 7.8 (High) with a local, low-complexity, authenticated (PR:L) vector, and no public exploit identified at time of analysis. Fixed in 2.2.7 and 2.3.4, where the restore-via-CreateContainer behavior is additionally disabled by default.
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory traversal with a malicious file upload to place and execute arbitrary scripts, resulting in full loss of confidentiality, integrity, and availability on the management server (vendor-assigned CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is network-exploitable with no authentication and no user interaction, so the decisive real-world factor is exposure: these servers are normally confined to internal administrative networks, and risk rises sharply if the affected upload endpoint is reachable from an untrusted network. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and affected version ranges are not enumerated in the available data.
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platform 4.17+, lets an authenticated Kubernetes user who can create a pod from a crafted checkpoint image bypass the destination pod's security context. The restored process keeps credentials, Linux capabilities, no_new_privs and seccomp state stored in the checkpoint instead of the destination configuration, allowing execution across the container security boundary. Exploitation requires non-default checkpoint/restore (CRIU) support to be enabled and RBAC permission to create pods from malicious checkpoints; no public exploit code is identified and no vendor-released fix is available at time of analysis, so the vendor CVSS 3.1 score of 8.8 overstates urgency given those prerequisites (our assessment raises attack complexity to High).
A path traversal (CWE-22) vulnerability in CRI-O's container checkpoint/restore feature allows a highly privileged, remote attacker to perform unintended operations on the host filesystem by supplying a malicious checkpoint archive during container restoration. Exploitation requires the non-default checkpoint/restore functionality to be enabled and the attacker to have high privileges (PR:H) to trigger restoration of untrusted content, resulting in a scope change from container to host with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit identified at time of analysis. Affected products include Red Hat OpenShift Container Platform 4 as per CPE data.
Argument injection in Appwrite before 2.0.0 allows an authenticated user holding the functions.write or sites.write permission to turn a crafted providerRootDirectory value into arbitrary GNU tar command-line arguments, escalating to remote code execution as the builds worker process user via payloads such as --checkpoint-action=exec. The flaw is not admin-only: the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 8.7 under CVSS 4.0) reflects that a low-privileged, authenticated account with deployment-write rights over a reachable Appwrite instance is sufficient, with no user interaction and no non-default configuration required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; a vendor-released fix is available in Appwrite 2.0.0, making this a genuine high-priority issue rather than a CVSS-inflated one.
Unsafe deserialization in the opt-in kedro_datasets_experimental.pytorch.PyTorchDataset connector (kedro-datasets versions 5.0.0 through <9.5.0) allows code execution during pipeline load, because the dataset calls torch.load on .pt files without enforcing weights_only=True and silently drops user-supplied load_args, so even an explicit weights_only override never reached PyTorch. Exploitation requires a PyTorch runtime earlier than 2.6 (where weights_only defaults to False) plus a victim pipeline that loads a checkpoint obtained from an attacker-influenced shared model registry, downloaded checkpoint, or partitioned external dataset; unauthenticated remote attackers can plant the payload but must wait for that user interaction, and pipelines loading only trusted files are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation; the vendor-released patch is version 9.5.0, which enforces weights_only=True by default and correctly forwards load_args and save_args.
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overflow is reachable through the login process before authentication completes. Because the flaw is triggered during the pre-authentication login path, a remote attacker with network reachability to the management server's login/administration service needs no credentials, no user interaction, and no non-default configuration, and the resulting code execution is described as running with root privileges - consistent with the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV), but the pre-auth, root-level impact and the criticality of the management plane make this a top-priority patch target; CPE data lists the product with a wildcard version, indicating the affected version range is not bounded in the available feed data.
Arbitrary code execution in ESPnet before v.202609 is triggered when a user loads an attacker-crafted PyTorch checkpoint through any of the framework's model initialization, fine-tuning, or averaging pipelines. The root cause is CWE-502 (Deserialization of Untrusted Data): ESPnet called torch.load with weights_only=False across at least four distinct code paths, allowing pickle-embedded payloads to execute arbitrary commands with the privileges of the ESPnet process. No public exploit has been identified at time of analysis, but the attack technique - crafting malicious PyTorch pickle checkpoints - is thoroughly documented in the ML security community and requires minimal skill to reproduce.
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based buffer overflow in the ASN.1 decoder that parses VPN certificates, reachable by unauthenticated remote attackers. Because the flaw sits in the certificate-handling path of the internet-facing VPN service, a single crafted certificate or handshake can overflow heap memory and execute attacker-controlled code on security appliances that sit at the network perimeter. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, but the pre-auth network-reachable RCE profile makes it a top-tier patching priority.
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during VPN negotiation, letting a remote unauthenticated attacker run arbitrary code on the gateway itself. The CWE-295 root cause means the gateway accepts or mishandles an untrusted/forged certificate in the IKE/SSL-VPN handshake, and processing that malicious certificate leads to code execution rather than merely a trust bypass. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. No public exploit specific to this CVE has been identified at time of analysis, and it is not listed in the CISA KEV catalog, but the underlying PyYAML unsafe deserialization class is extensively documented and exploit techniques are widely known.
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
Remote code execution in Hugging Face PyTorch Image Models (timm) version 1.0.24 is triggered when a user loads a crafted model checkpoint file, exploiting unsafe deserialization of untrusted data. The vulnerability, discovered by ZDI (ZDI-CAN-27987) and tracked as ZDI-26-523, allows an attacker who can deliver a malicious checkpoint to achieve full code execution in the context of the victim's process with no special system privileges required. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the attack surface is practically significant in ML/AI workflows where downloading pretrained checkpoints from public sources is routine.
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-manager access to execute arbitrary commands on a managed SSH host prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-supplied file basenames directly to GNU tar without an end-of-options delimiter, enabling an attacker to supply filenames matching tar checkpoint options (e.g., --checkpoint=1, --checkpoint-action=exec=<cmd>) that tar interprets as directives rather than operands. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the exploitation technique is well-documented and the CVSS score of 8.8 reflects genuine high-priority risk for all pre-2.3.2 deployments.
Concurrent event manipulation during CRIU checkpointing in the Linux kernel's AMD GPU driver (drm/amdkfd) exposes a race condition leading to heap out-of-bounds writes or use-after-free memory corruption. A low-privileged local attacker on a system with an AMD GPU can exploit the unprotected gap between the event count and IDR walk in kfd_criu_checkpoint_events() by racing event creation or destruction from a second thread within the same process, producing kernel heap corruption primitives exploitable for local privilege escalation. No public exploit code and no CISA KEV entry have been identified at time of analysis; EPSS is 0.17% (6th percentile), reflecting low current adversary interest despite the high C:H/I:H/A:H CVSS impact triad.
Arbitrary code execution in Fujitsu Research's OneCompression (onecomp) Python library 1.2.0 is triggered when a victim loads a crafted PyTorch checkpoint file via the library's QuantizedModelLoader API, which unconditionally invokes Python's pickle machinery. The root cause is the hardcoded use of torch.load with weights_only=False in load_quantized_model_pt(), allowing an attacker-supplied checkpoint to embed malicious __reduce__ methods that execute arbitrary Python - including OS commands - in the context of the loading process. No public exploit code has been identified at time of analysis, though a patched version (1.2.1) is available on PyPI per the VulnCheck advisory.
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with AMD v9 GPU hardware. The MQD control stack copy uses cp_hqd_cntl_stack_size directly from hardware registers without bounding it to the allocated Buffer Object, allowing memcpy to read past the BO into adjacent GTT memory. A local low-privileged user with access to AMD GPU compute queue checkpointing can recover sensitive kernel data; no public exploit has been identified at time of analysis, though the 15% EPSS score is above baseline for kernel information-disclosure flaws.
Authentication bypass in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) lets an unauthenticated remote attacker with network access to Management services execute arbitrary commands and fully compromise the management system. It affects a broad range of releases (R80 through R82.10) including R81.20 and R82 running Jumbo Hotfix Accumulator takes at or below fixed thresholds. There is no public exploit identified at time of analysis; Check Point found the flaw internally and reports no indication of active exploitation despite the critical CVSS 4.0 score of 9.3.
Privilege escalation in CRIU allows a malicious container process to spoof credentials during checkpoint, resulting in elevated capabilities upon restore. On Red Hat platforms, effective exploitation is mitigated by mandatory access controls, user namespaces, and the requirement for privileged checkpoint initiation. No public exploit identified at time of analysis.
Authentication denial of service in Pterodactyl Panel 1.7.0–1.12.4 allows an unauthenticated remote attacker to lock out all users from login and two-factor authentication by exhausting a single shared rate-limit bucket with approximately 10 requests per minute. The attacker can sustain the lockout indefinitely, preventing legitimate access including administrative login. A proof-of-concept is publicly available, though no active exploitation has been reported via CISA KEV.
Privilege escalation in Check Point Gaia Portal allows an authenticated user holding only read-only administrative privileges to execute arbitrary commands as root, giving full compromise of the affected Quantum Security Gateway or Security Management appliance. The flaw (CWE-269, improper privilege management) is vendor-reported via advisory sk185153 and carries a CVSS 3.1 base score of 7.5 with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Check Point Quantum Security Management and Multi-Domain Security Management lets an unauthenticated remote attacker (CVSS:3.1 PR:N) run administrative commands directly on the Management Server, and potentially pivot to command execution on the managed Security Gateways it controls. It affects a broad range of releases (R77.30 through R82.10) up to specific Jumbo Hotfix Takes, but real-world exploitability hinges on the Management Server being network-reachable without firewall protection or without a restrictive Trusted Clients policy. At time of analysis there is no public exploit identified and no CISA KEV listing, so this is a high-severity but not-yet-weaponized issue.
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid application login token and log in with full administrative privileges to Quantum Security Management and Multi-Domain Security Management servers (CWE-287, CVSS 4.0 9.3). Once authenticated, the attacker can rewrite security policies and configurations across managed gateways. It is confirmed actively exploited (CISA KEV) with publicly available exploit code, though Check Point reports only a very small number of affected customers, and the EPSS score is a modest 1.07% (61st percentile), consistent with targeted rather than mass exploitation.
Local denial-of-service and out-of-bounds read in the Linux kernel F2FS filesystem allows an attacker who can mount a crafted image to panic the kernel via f2fs_recover_orphan_inodes(), which trusts an attacker-controlled orphan block entry_count. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK drives the recovery loop past the ino[] array, reading footer/adjacent data as inode numbers and tripping f2fs_bug_on(). No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV.
Filesystem metadata corruption in the Linux kernel's F2FS (Flash-Friendly File System) driver arises from a race between f2fs_need_dentry_mark() reading nat_entry flags and the concurrent checkpoint path, so a node folio can be written with the DENT_BIT_SHIFT dentry-mark set even though the inode was already checkpointed. After a sudden power-off, fsck detects this inconsistent inode state. This is a local, low-privilege integrity/availability issue with no public exploit identified at time of analysis; EPSS is low at 0.17% and it is not listed in CISA KEV.
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious checkpoint file to execute arbitrary code. The flaw lives in the _load_state routine, which imports and calls the module path named in a checkpoint's _instantiator hyperparameter, letting a crafted .ckpt bypass torch's weights_only=True safeguard when LightningModule.load_from_checkpoint is invoked. Reported by VulnCheck, it is fixed in commit d710d68 (PR #21832) via an instantiator allowlist, and publicly available exploit code exists though it is not listed in CISA KEV.
Block suppression via ZIP-244 transaction malleability in zebrad up to v4.4.1 allows a remote unauthenticated P2P peer to permanently stall a target node at a specific block height by poisoning the sent-hash cache with a validation-rejected block whose hash is never cleaned up. The root cause is that `non_finalized_block_write_sent_hashes` records a block's header hash before contextual validation completes, and on failure the stale entry remains, causing any subsequent delivery of the legitimate canonical block to be discarded as a duplicate. No active exploitation is listed in CISA KEV, but the Zcash Foundation advisory credits two independent researchers with E2E reproduction, confirming the attack is practically executable against all default configurations; vendor-released patch zebrad 4.5.0 is available.
Local information disclosure and memory corruption in the Linux kernel's AMD KFD (amdkfd) driver affects GFX11/Navi3x GPUs, where the v11 MQD manager wrongly used CP-compute checkpoint/restore handlers for SDMA queues. During a CRIU checkpoint or restore of an SDMA queue, the driver treats a 512-byte v11_sdma_mqd buffer as a 2048-byte v11_compute_mqd, so it either leaks 1536 bytes of adjacent GTT memory to userspace or overwrites 1536 bytes of neighboring GTT memory (ring buffers or adjacent MQDs). Exploitation requires local access with the ability to drive CRIU checkpoint/restore of a GPU compute process; there is no public exploit identified at time of analysis and EPSS is low (0.18%).
Local privilege escalation and information disclosure in the Linux kernel's SysV IPC subsystem stems from an unbounded ID allocation in ipc_idr_alloc() along the checkpoint/restore (CRIU) path, where a user-supplied next_id can spill past the valid ipc_mni range. Because removal truncates the index via ipcid_to_idx(), a high-index object can be freed while its real IDR slot dangles, so a subsequent /proc/sysvipc/shm walk dereferences freed memory - a use-after-free. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile) and the issue is not on CISA KEV.
Arbitrary code execution in Stanford NLP's Stanza 1.12.0 (and ≤1.12.1) occurs when the library loads a malicious PyTorch checkpoint, because its pretrain loader silently falls back from torch.load(weights_only=True) to weights_only=False whenever an UnpicklingError is raised - a condition the attacker fully controls by embedding one unsupported pickle global. Publicly available exploit code exists (working PoC in the GHSA advisory), and any developer, CI pipeline, or production NLP service that downloads Stanza model files from HuggingFace, GitHub, or a shared cache can be compromised. Fixed in Stanza 1.12.2.
Kubernetes device-plugin and resource-allocation enforcement can be bypassed in containerd by a namespace user holding pod-creation rights, who restores a container from a maliciously crafted checkpoint image. The CRI restore path trusts Container Device Interface (CDI) annotations embedded in untrusted checkpoint metadata instead of the pod's create-time spec, letting the attacker smuggle arbitrary CDI edits (host device nodes and mounts) into the restored container. It affects containerd v2.1.0-2.1.8, v2.2.0-2.2.4 and v2.3.0-2.3.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary host file disclosure in containerd's CRI plugin lets an attacker read any file on the Kubernetes node via `kubectl logs` because the plugin restores `container.log` from a checkpoint image while blindly following a symlinked path. All containerd 2.x branches before 2.1.9, 2.2.5, and 2.3.2 are affected wherever container checkpoint/restore (CRIU-based) is used. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw was independently reported by numerous researchers and a vendor patch is available.
Heap-based buffer overflow in stable-diffusion.cpp's pickle .ckpt parser allows attackers to corrupt memory and likely achieve code execution when a victim loads a maliciously crafted checkpoint file. The flaw stems from sign confusion in the BINUNICODE opcode length field, causing memcpy to be called with an attacker-controlled, effectively gigantic size derived from a negative signed integer. No public exploit identified at time of analysis, and the issue is fixed in master-584-0a7ae07.
Heap buffer overflow in the leejet stable-diffusion.cpp pickle .ckpt parser allows arbitrary code execution when a user or host application loads a maliciously crafted checkpoint file. The flaw resides in the GLOBAL opcode handler within src/model.cpp, where missing newline validation lets a -1 length value drive a heap memory copy, corrupting the heap of the diffusion inference process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the attack surface (community model-sharing sites) makes weaponization plausible.
Heap buffer overflow in stable-diffusion.cpp versions prior to master-584-0a7ae07 allows attackers to corrupt memory and potentially achieve code execution when a victim loads a malicious PyTorch .ckpt checkpoint file. The flaw resides in the SHORT_BINUNICODE opcode handler of the pickle parser in src/model.cpp, where a signed length field is mishandled and passed to memcpy. No public exploit identified at time of analysis, but the upstream fix is committed and the attack surface (untrusted model files from sharing sites) is realistic for AI/ML workloads.
Local privilege escalation in Check Point Identity Agent Full for Windows allows an authenticated local user to execute arbitrary code with SYSTEM privileges through improper executable resolution during the log collection process. The flaw is a classic CWE-427 uncontrolled search path issue, and no public exploit has been identified at time of analysis. Exploitation is constrained to attackers who already have a foothold on the endpoint but provides a reliable path to full SYSTEM compromise.
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attackers to establish Remote Access and Mobile Access VPN sessions without valid credentials by abusing a logic flaw in deprecated IKEv1 certificate validation. The flaw (CVSS 9.3, CWE-287) was reported by Check Point themselves and publicly available exploit code exists, though EPSS exploitation probability remains very low (0.01%) and the issue is not currently listed in CISA KEV. Affected deployments include multiple Quantum R80.40-R82.10 trains and Spark R80.20.X-R82.00.X firmware.
Certificate validation bypass in Check Point Quantum Security Gateway and Spark Firewalls allows network-positioned attackers to subvert IKEv1 certificate-based authentication in site-to-site VPN tunnels. A man-in-the-middle adversary can intercept or modify traffic traversing the tunnel without possessing valid credentials. No public exploit identified at time of analysis, and the issue is constrained to the deprecated IKEv1 protocol path.
Arbitrary code execution in ESA AnomalyMatch before 1.3.1 allows local attackers with low privileges to run code under the application's process by planting a malicious PyTorch checkpoint into a session directory, which is loaded via torch.load() with weights_only=False. No public exploit is identified at time of analysis, but the upstream fix (PR #9) and a third-party advisory (imlabs.info) confirm the unsafe-deserialization root cause and the migration to safetensors.
Unauthenticated information disclosure in Check Point Quantum Security Gateway allows remote attackers to read internal files on the appliance when the Identity Awareness blade is configured with Browser-Based Authentication. The flaw maps to CWE-98 (PHP file inclusion) and carries a CVSS 7.5 with confidentiality-only impact; EPSS is low (0.10%) and there is no public exploit identified at time of analysis, but the unauthenticated network reach against a perimeter gateway makes triage urgent for affected deployments.
Denial of service in Check Point Quantum Security Gateway allows remote unauthenticated attackers to crash the VPN processing service by sending specially crafted IKE packets over NAT-T (UDP/4500). Multiple supported releases (R81.10 and below, R81.20, R82, R82.10) are affected up to specific Jumbo Hotfix takes. No public exploit identified at time of analysis, and EPSS is low at 0.06% (17th percentile), suggesting limited near-term exploitation likelihood despite the 8.1 CVSS score.
Denial of service in Check Point Quantum Security Gateway allows remote unauthenticated attackers to terminate the VPN service by sending a malformed IKE fragment to UDP port 500 during the early phase of a connection attempt. The flaw affects multiple R81.x, R82, and R82.10 release trains running below specific Jumbo Hotfix Takes; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 5th percentile).
Arbitrary code execution occurs in PyTorch Lightning 2.6.0 and earlier when loading malicious checkpoint files. The LightningModule.load_from_checkpoint() method deserializes untrusted Pickle data without security restrictions, allowing attackers to execute arbitrary Python code when victims open crafted .ckpt files. EPSS score of 0.06% (19th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis. Attack requires local access and user interaction (opening a malicious checkpoint), limiting remote attack scenarios to social engineering or supply chain compromise.
Arbitrary code execution via torch-checkpoint-shrink.py script in ml-engineering project allows remote attackers to execute malicious Python code by providing crafted PyTorch checkpoint files. The vulnerability stems from insecure deserialization where torch.load() processes .pt files without the weights_only=True safeguard, enabling pickle-based arbitrary object instantiation. Despite a critical CVSS 9.8 score, EPSS probability is low (0.06%, 19th percentile) and no public exploit or active exploitation is confirmed, suggesting limited real-world targeting to date. SSVC assessment indicates total technical impact with automatable exploitation potential, making this a priority for organizations using ml-engineering scripts in production environments.
Arbitrary code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load malicious model checkpoint files through the Trainer.load() method. The vulnerability stems from unsafe PyTorch deserialization that processes untrusted Pickle objects without the weights_only security parameter. Attackers can embed malicious Python code in model files distributed through repositories, shared datasets, or social engineering campaigns. Despite the 8.8 CVSS score indicating critical severity, EPSS scoring at 0.06% (19th percentile) suggests very low real-world exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Arbitrary code execution in CosyVoice (FunAudioLLM's open-source multilingual text-to-speech toolkit) arises because its average_model.py utility calls PyTorch's torch.load() on epoch_*.pt checkpoint files without weights_only=True, allowing pickle-based deserialization of attacker-controlled objects. Any user who runs the model-averaging tool against a directory containing a malicious checkpoint executes attacker code on their machine. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), but the CWE-502 pattern is trivially weaponizable and SSVC marks it automatable.
Arbitrary code execution in the Dao-AILab flash-attention training framework (all revisions up to and including commit e724e2588cbe754beb97cf7c011b5e7e34119e62) arises because its checkpoint-loading paths call PyTorch's torch.load() without weights_only=True, permitting pickle-based deserialization of attacker-controlled objects. Any user who warmstarts or evaluates a model from an untrusted checkpoint file triggers code execution on their host. No public exploit is identified at time of analysis, EPSS is negligible (0.02%), and SSVC records exploitation as 'none' - this is a latent supply-chain/ML-artifact risk rather than an actively exploited one.
Cross-tenant Insecure Direct Object Reference (IDOR) in Aegra 0.9.0-0.9.6 allows any authenticated user to execute graph runs against other users' threads, exfiltrate full checkpoint state including conversation histories, and inject malicious messages into victims' threads by supplying known thread UUIDs to POST /threads/{thread_id}/runs endpoints. Thread IDs leak through frontend URLs, server logs, and observability traces, eliminating need for enumeration. Vendor-released patch (v0.9.7) confirmed by GitHub advisory GHSA-m98r-6667-4wq7. No active exploitation or POC identified at time of analysis, though detailed reproducer exists in issue #336.
Remote code execution in HuggingFace Transformers library allows arbitrary code execution via malicious checkpoint files. The `_load_rng_state()` method in the `Trainer` class calls `torch.load()` without the `weights_only=True` parameter, enabling deserialization attacks when PyTorch versions below 2.6 are used with torch>=2.2. An attacker can craft a malicious `rng_state.pth` checkpoint file that executes arbitrary code when loaded by an application using affected Transformers versions. The fix is available in version v5.0.0rc3, and no public exploit has been independently confirmed at time of analysis.
Directory traversal in agentic-context-engine up to version 0.7.1 enables arbitrary file writes through the checkpoint_dir parameter in OfflineACE.run, exploiting inadequate path normalization in the save_to_file method. Unauthenticated attackers can overwrite arbitrary files within the application process's permissions scope, potentially achieving code execution, privilege escalation, or application compromise depending on deployment context and file system layout.
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 76.7%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Path traversal in the Dexbotic gr00tsonic Checkpoint Loader (dexbotic/model/gr00tsonic/gr00tsonic_arch.py, function load_pretrained_gr00t) allows an attacker who controls the weight_map argument to cause file paths outside the intended checkpoint location to be used during checkpoint loading. Dexbotic 0.1 and 0.2.0 are listed as affected (CPE cpe:2.3:a:dexmal:dexbotic:*), and exploitation is remote but requires the victim to actually load an attacker-influenced pretrained checkpoint - per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L vector no authentication is needed, while passive user interaction is the primary limiting factor. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists but it is not verified as working exploit code, and the project has been notified through an issue report without a response, so the issue is assessed as low priority (monitor).
Cross-namespace data exposure in the Postgres- and SQLite-backed LangGraph stores (langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2) lets an authenticated, low-privileged caller who can influence a namespace label read, overwrite, or delete items stored under a different tenant's namespace. The stores flatten a namespace with ".".join(namespace), so a single label such as ("tenant.bob",) resolves to the same stored text as ("tenant", "bob"); only put/aput validated labels, while get, search, delete, list_namespaces, their async variants, and ops passed straight to batch/abatch accepted dotted labels unchecked. Exposure is deployment-dependent rather than universal: it requires an application that relies on namespace tuples to isolate tenants and passes untrusted input into those calls, InMemoryStore is unaffected because it compares namespace tuples, and there is no public exploit identified at time of analysis. The reported CVSS 4.0 score is 6.0, while the independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
Path traversal in Entire CLI 0.7.6 and earlier lets a collaborator who can push to the shared `entire/checkpoints/v1` branch overwrite arbitrary files on another user's machine: when the victim runs `entire session resume` or `entire checkpoint rewind`, a crafted SessionID in checkpoint metadata is used to build restore filesystem paths without validation, so attacker-controlled transcript data is written outside the expected session directory. Both the push access to the checkpoints branch and the victim's explicit invocation of resume/rewind are required, which keeps this a precondition-heavy, supply-chain-style issue rather than a drive-by exploit; no public exploit code or confirmed active exploitation has been identified at time of analysis, and notification is tracked as a moderate-priority this-month item. Successful abuse yields high integrity impact on other systems' components (scope change) and limited availability impact.
Authorization bypass in n8n's agent chat resume endpoint allows an authenticated member of a shared n8n project to read other members' private agent conversations and approve their pending tool calls, causing those tools to execute and write results back into the victim's conversation. The flaw affects n8n releases before 2.41.4 and 2.42.0 and is rooted in an insecure direct object reference (CWE-639): the resume endpoint accepts a run identifier from the request body without verifying that the referenced suspended checkpoint belongs to the caller. Exploitation requires a valid project-member account (PR:L) plus the stateful condition that another user's agent-chat checkpoint is currently suspended and awaiting tool-call approval (AT:P), so this is primarily a multi-tenant or shared-project insider risk; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed severity is moderate (CVSS 3.1 base 6.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Path traversal in MosaicML Composer 0.32.1 and earlier allows an attacker who supplies a crafted checkpoint archive to write files outside the intended extraction directory when the victim loads that checkpoint, because the tarball.extractall routine in composer/utils/checkpoint.py does not sanitize archive entry paths (CWE-22). The attack is remote and, per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P), requires only passive user interaction - someone must ingest an untrusted checkpoint, for example one pulled from a model hub, shared storage, or a supply-chain source; the independent assessment corroborates this as CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, i.e., limited integrity and availability impact with no confidentiality loss. No public exploit code was identified and the issue is not in CISA KEV, so this is a medium-severity (base 5.3) supply-chain hygiene problem rather than an actively exploited emergency; teams that only load internally generated, trusted checkpoints are not realistically exposed.
In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf_loop() call was verified on a second iteration. Consider the following verification trace: - main: bpf_loop(nr_loops, callback ...) - callback: BPF_EXIT - main: bpf_loop(nr_loops, callback ...) - ... While the first visit of the call to bpf_loop() propagated R1 precision as expected, the second call to mark_chain_precision() in the check_helper_call() set R1, but it was immediately reset when backtrack_insn() processed preceding BPF_EXIT in the loop deleted in this patch. Because of that, the second visit of the call to bpf_loop() injected checkpoint with R1 not marked as precise. Which could trick the verifier into accepting unsafe programs. See the next patch for an example of such program. Commit is structured in a way to minimize conflicts when 'bpf' would be eventually merged with 'bpf-next'.
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check check_cond_jmp_op() accepts "if rA <op> rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTR_MAYBE_NULL from rA in the corresponding branch and does not mark rB precise. Consider the following program: r0 = bpf_get_prandom_u32(); r6 = 1; /* the r6 == 0 path is explored first */ if (r0 == 0) goto 1f; r6 = 0; 1: r0 = bpf_map_lookup_elem(map, &0); /* absent, NULL at runtime */ if (r0 == r6) goto 2f; /* taken as a NULL check for r0 */ *(u8 *)(r0 + 0); /* verifier: map value; runtime: zero */ 2: return 0; The r6 == 0 path is explored first and the dereference is accepted. The r6 == 1 path is pruned at the checkpoint recorded for (1), so the comparison is never verified with a non-zero r6. At runtime a failed lookup returns NULL, NULL != 1 takes the non-NULL edge and the program dereferences a pointer that is zero.
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise. A state checkpoint reached with an imprecise zero can therefore prune a second path that reaches the store with an arbitrary nonzero scalar. The program can write attacker-controlled bits into the kptr field and load them back as a PTR_TO_BTF_ID. Call mark_chain_precision() before accepting a known-zero register. This forces state equivalence to compare its scalar range and makes the verifier visit and reject a path carrying a nonzero value.
In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag.
In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range(), the curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. Even though these in-memory curseg types are not saved in the on-disk checkpoint header, they still occupy active physical segments at runtime. If an active in-memory curseg happens to be allocated within the segment range being truncated during filesystem shrink, failing to evacuate it will cause subsequent writes to the curseg attempting out-of-bounds I/O on the truncated storage range. Fix this by expanding the curseg evacuation loop upper bound to NR_CURSEG_TYPE to ensure all active curseg types are safely migrated out of the target range.
In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_priority updates with s_umount The sysfs store path already takes s_umount for GC thread control entries, and ckpt_thread_ioprio is covered as well. critical_task_priority also updates checkpoint or GC kthread scheduling state, but it is not covered by that serialization. It can race with remount or teardown paths that are stopping those threads. Protect critical_task_priority sysfs writes with s_umount too.
In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget. If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j_list_lock. Large checkpoint lists can result in excessive lock hold times and leave other CPUs spinning on j_list_lock, causing soft lockups or RCU stalls. Pass nr_to_scan into journal_shrink_one_cp_list() and decrement it for every buffer examined, including busy buffers. Pass NULL from checkpoint cleanup paths so their existing full-list behavior is preserved. This restores the scan-budget semantics that existed before journal_shrink_one_cp_list() was changed to always scan a complete checkpoint list.
In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body. Consequently, when a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock, even when a reschedule has been requested. Large checkpoint lists under memory pressure can therefore cause long lock hold times and leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls. Route the busy-buffer path through the need_resched() check so that the shrinker can release j_list_lock and reschedule promptly, restoring parity with the clean-buffer path, which already checks need_resched(). This does not change which checkpoint buffers are eligible for removal.
HTTP response splitting and downstream desynchronization in undici's retry interceptor allows an attacker-controlled upstream server to cause downstream HTTP/1.1 clients to misinterpret response boundaries. Affected releases are undici before 6.28.1, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1. When a proxying application relays the malformed response without normalizing framing, excess bytes appended by the retry interceptor can be parsed by a downstream HTTP/1.1 peer as the start of a subsequent response, enabling response injection or session desynchronization attacks.
Arbitrary file read in Hugging Face Transformers allows an attacker who controls a model checkpoint index file to exfiltrate files from the host filesystem outside the intended model directory. The library fails to sanitize shard filenames in checkpoint index files before joining them to directory paths, meaning maliciously crafted entries containing parent-directory sequences or absolute paths resolve to unintended locations. Any user or automated pipeline that loads an attacker-supplied checkpoint - for example, by downloading a model from an untrusted Hub repository - can have host files disclosed without code execution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() During unmount, ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2_evict_inode() -> ocfs2_clear_inode() -> ocfs2_checkpoint_inode() -> ocfs2_ci_fully_checkpointed() dereferences osb->journal, causing a NULL pointer dereference. Fix this by adding a NULL check for osb->journal in ocfs2_checkpoint_inode(). If the journal is NULL, it has already been fully flushed and destroyed during shutdown, so there is nothing to checkpoint.
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafted sharded checkpoint: sensitive file disclosure via relative (../) or absolute path entries in the weight_map index, and indefinite process blocking via named pipe references enabling denial of service. A publicly available proof-of-concept exists at GitHub issue #4067, reported by VulnCheck. With no system-level privileges required (PR:N per CVSS 4.0), this is a supply chain risk for any ML practitioner who loads untrusted model checkpoints - particularly from public model registries - without needing any foothold on the target system beyond delivering the malicious checkpoint.
Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.
Unsafe deserialization in HashNeRF-pytorch's Checkpoint File Handler allows a local low-privileged attacker to achieve arbitrary code execution by supplying a malicious file via the `ckpt_path` argument to `torch.load()` in `run_nerf.py`. All commits up to 82885e698295982504eb6a26d060a6b2473e3706 are affected; a fix exists as an unmerged pull request (PR #50). A public exploit has been disclosed via GitHub issue #49, though no CISA KEV listing has been identified, indicating no confirmed widespread active exploitation at time of analysis.
Kernel denial-of-service in Zephyr RTOS v4.4.0's Dhara flash translation layer driver crashes the system during FTL disk initialization when a flash error coincides with the journal-resume checkpoint scan. The driver's dhara_nand_read/erase/prog/copy callbacks unconditionally dereference the caller-supplied err pointer, but the upstream Dhara library legitimately passes NULL during its binary search in find_last_checkblock(), triggering a NULL write and kernel fault. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; exploitation is gated on specific flash media conditions (uncorrectable ECC, bad block, or induced fault) occurring on a checkpoint page at mount time, constraining real-world risk to physical or supply-chain threat models.
Process abort in zebrad (Zcash Foundation's Rust node) up to v4.4.1 allows a malicious block producer to crash targeted nodes by submitting a child block that repeats a shielded V5 transaction from its non-finalized parent. The ordering bug in `Chain::push` causes an `assert_eq!` uniqueness check on `tx_loc_by_hash` to fire before the duplicate shielded-nullifier guard can cleanly reject the block; under Zebra's `panic = "abort"` release profile, this terminates the entire node process rather than returning a validation error. No public exploit or CISA KEV listing has been identified, but the vendor describes two concrete attack models requiring only modest mining hashrate, making targeted denial-of-service achievable in practice.
Workflow checkpoint endpoints in ComfyUI-Copilot up to 2.0.28 expose an insecure direct object reference (IDOR) flaw - the restore_workflow_checkpoint and update_workflow_ui handlers in conversation_api.py accept externally supplied version identifiers without verifying that the referenced checkpoint belongs to the requesting session, enabling an authenticated remote attacker to read workflow data owned by other sessions. The CVSS 4.0 score of 2.3 reflects limited confidentiality-only impact and high attack complexity (AC:H) due to the need to enumerate valid cross-session identifiers. A proof-of-concept is publicly available at GitHub issue #149; the upstream fix (PR #150) is pending acceptance and no patched release version has been confirmed.
Data loss in the Linux kernel's f2fs (Flash-Friendly File System) driver exposes files created and synced before any checkpoint has been written to permanent loss on sudden power off. The race condition between fsync on newly created files and concurrent checkpoint operations causes f2fs_need_inode_block_update() to misread prematurely set nat_entry flags (IS_CHECKPOINTED and HAS_LAST_FSYNC), leading fsync to skip the inode block flush it actually requires. No public exploit identified at time of analysis; the EPSS score of 0.16% at the 6th percentile reflects the narrow triggering conditions and local-only attack surface.
Checkpoint image poisoning in containerd's CRI implementation allows an attacker with pod-creation permissions to corrupt the node-local image cache, causing victim pods to silently execute malicious images in place of legitimate ones. The root cause is missing validation of image references embedded in checkpoint image configurations: containerd trusts attacker-controlled strings in the checkpoint archive to drive image pulls and local tag assignment. Subsequent pods using an IfNotPresent or Never pull policy then inherit the poisoned tag and execute arbitrary code under the victim pod's Kubernetes identity. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; vendor-released patches are available.
Unsafe deserialization in LangGraph SQLite Checkpoint's JsonPlusSerializer (versions 4.1.0 and prior) allows arbitrary Python object reconstruction from checkpoint payloads stored in a SQLite backing store, enabling code execution at checkpoint load time. Affected deployments are those where an unauthorized party can modify checkpoint bytes at rest - a high-privilege prerequisite (PR:H, AV:A per CVSS) that already implies a significant prior compromise. This is explicitly framed as a defense-in-depth concern: the issue escalates an existing 'checkpoint-store write access' incident into full application runtime code execution. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds reads in stable-diffusion.cpp's PyTorch pickle checkpoint parser (versions prior to master-584-0a7ae07) allow a crafted or truncated .ckpt file to crash the loading application or leak process memory contents. The pickle opcode handlers in src/model.cpp advanced the buffer pointer without verifying remaining bytes before each read, meaning any application using this library to load untrusted .ckpt model files is exposed to denial-of-service and potential memory disclosure. No public exploit has been identified at time of analysis, though LibFuzzer triggered crashing inputs in under one second, indicating an extremely low barrier for generating working crash payloads.
NoSQL injection in LangGraph's MongoDBSaver allows attackers to bypass thread scoping and read checkpoint data from other tenants. Vulnerable versions (<=1.3.0) of @langchain/langgraph-checkpoint-mongodb accept object-based MongoDB operators (e.g., $gt, $ne) in configurable identifier fields, leading to unauthorized cross-tenant data access. No active exploitation is confirmed (CISA KEV absent), and EPSS is very low (0.03%), but a public exploit example exists and a patch is available.
Incomplete macro-block state synchronization in Nimiq core-rs-albatross LightBlockchain allows a network-accessible attacker to permanently stall a light client's chain progression by triggering a rebranch to a fork whose tip is a macro (checkpoint or election) block. Affected are all deployments of the Rust Albatross light client prior to v1.4.0. When exploitation targets an election block specifically, the stale current_validators pointer causes every subsequent push() call to fail verify_validators(), rendering the light client unable to advance its chain. No public exploit identified at time of analysis, though the exact fix is visible in merged PR #3706 and the triggering conditions are fully described in the advisory.
Cross-domain RBAC bypass in Check Point Quantum Security Management allows an authenticated administrator with read-write access to one Management Domain (CMA) to modify Compliance Best Practices metadata stored in a separate Management Domain where they hold no permissions. The underlying root cause is SQL injection (CWE-89, corroborated by the 'SQLi' intelligence tag), suggesting the Compliance feature's metadata storage does not enforce domain-level query isolation. Affected releases span R81.10 and below, R81.20 up to Jumbo Hotfix Take 127, R82 up to Jumbo Hotfix Take 91, and R82.10 up to Jumbo Hotfix Take 19. No public exploit identified at time of analysis, and EPSS of 0.04% reflects low observed exploitation probability.
Heap-based buffer overflow in Check Point Quantum Security Gateway's HTTP-based service allows unauthenticated remote attackers to cause availability disruption by sending crafted malformed HTTP requests requiring no authentication or user interaction. Affected deployments span all R81.10 releases and below, R81.20 through Jumbo Hotfix Take 127, R82 through Jumbo Hotfix Take 91, and R82.10 through Jumbo Hotfix Take 19. No public exploit identified at time of analysis, though SSVC classifies the attack as automatable with total technical impact - a meaningful tension with the CVSS A:L rating that security teams should scrutinize before deprioritizing.
Arbitrary Python code execution in docTR through 1.1.0 is possible when load_pretrained_params() deserializes an attacker-controlled or tamperable checkpoint on PyTorch releases before 2.6. Unauthenticated attackers can supply the poisoned model artifact, but exploitation is conditionally gated: the victim application must load that checkpoint from a path or URL the attacker controls, and PyTorch must predate 2.6, where torch.load began defaulting to weights_only=True. No public exploit code or CISA KEV entry was identified at time of analysis, and this is a genuine but conditionally-gated code-execution flaw rather than a drop-everything emergency.
Authorization bypass in IntentKit through 2.6.3 allows unauthenticated callers to execute owner-only, state-changing tools - wallet transfers, social posting, memory writes, and agent-to-agent calls - on agents reachable through WEB, API, Twitter, or Telegram contexts. The executor authorizes each tool call against the complete tool registry instead of the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, so an attacker who knows the exact de-advertised tool name and supplies valid arguments can drive it via indirect prompt injection or by replaying checkpoint and history data on a reused thread, with no human-in-the-loop or approval gate intervening (CWE-862, missing authorization). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; risk is driven by the fully remote, unauthenticated, low-complexity vector with high integrity impact (CVSS 4.0 base 8.7), and exploitation still requires knowledge of the specific restricted tool names plus a working injection or replay channel against an agent that actually has those tools registered.
Unsafe deserialization in NVIDIA Megatron-LM's checkpoint-loading routine allows an attacker to execute arbitrary code, escalate privileges, disclose information, and tamper with data by convincing a user to load a maliciously crafted checkpoint or model file into the framework. The flaw is rated CVSS 7.8 (High) and is reachable only when a victim actually opens an attacker-supplied checkpoint, so organizations that load checkpoints exclusively from trusted internal sources are not realistically exposed; the vulnerable path is local (AV:L) and depends on user interaction per our assessment, with no network service or authentication bypass involved. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV, though the availability of proof-of-concept tooling for pickle-based deserialization attacks in ML frameworks makes this class of issue practically exploitable once a crafted checkpoint is delivered.
Deserialization of untrusted data in the NVIDIA Megatron-LM checkpoint-loading path allows code execution, privilege escalation, information disclosure, and data tampering when a user is convinced to load a maliciously crafted checkpoint file. NVIDIA PSIRT scores this CVSS 7.8 (High) and both the vendor and the independent assessment agree on full confidentiality, integrity, and availability impact; the assessments differ on prerequisites, with the vendor vector indicating low privileges and no user interaction (PR:L/UI:N) while the independent assessment models it as no privileges with required victim interaction (PR:N/UI:R). No public exploit code or CISA KEV entry was identified at time of analysis, and only environments that actually load untrusted checkpoints are exposed; code runs with the privileges of the loading user or process, not inherently as root.
Privilege escalation in containerd's CRI checkpoint-restore path allows an authenticated local attacker who can submit an attacker-controlled checkpoint archive via CRI CreateContainer to have the restored process run with restored credentials (including root), full capabilities, and restored no_new_privs and seccomp state, while CRI status continues to report the requested ContainerConfig. The flaw affects containerd 2.1.0 through 2.2.6 and 2.3.0 through 2.3.3, and only where CRI checkpoint restore via CreateContainer is actually used; systems that never use this experimental feature are not affected. Rated CVSS 7.8 (High) with a local, low-complexity, authenticated (PR:L) vector, and no public exploit identified at time of analysis. Fixed in 2.2.7 and 2.3.4, where the restore-via-CreateContainer behavior is additionally disabled by default.
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory traversal with a malicious file upload to place and execute arbitrary scripts, resulting in full loss of confidentiality, integrity, and availability on the management server (vendor-assigned CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is network-exploitable with no authentication and no user interaction, so the decisive real-world factor is exposure: these servers are normally confined to internal administrative networks, and risk rises sharply if the affected upload endpoint is reachable from an untrusted network. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and affected version ranges are not enumerated in the available data.
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platform 4.17+, lets an authenticated Kubernetes user who can create a pod from a crafted checkpoint image bypass the destination pod's security context. The restored process keeps credentials, Linux capabilities, no_new_privs and seccomp state stored in the checkpoint instead of the destination configuration, allowing execution across the container security boundary. Exploitation requires non-default checkpoint/restore (CRIU) support to be enabled and RBAC permission to create pods from malicious checkpoints; no public exploit code is identified and no vendor-released fix is available at time of analysis, so the vendor CVSS 3.1 score of 8.8 overstates urgency given those prerequisites (our assessment raises attack complexity to High).
A path traversal (CWE-22) vulnerability in CRI-O's container checkpoint/restore feature allows a highly privileged, remote attacker to perform unintended operations on the host filesystem by supplying a malicious checkpoint archive during container restoration. Exploitation requires the non-default checkpoint/restore functionality to be enabled and the attacker to have high privileges (PR:H) to trigger restoration of untrusted content, resulting in a scope change from container to host with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit identified at time of analysis. Affected products include Red Hat OpenShift Container Platform 4 as per CPE data.
Argument injection in Appwrite before 2.0.0 allows an authenticated user holding the functions.write or sites.write permission to turn a crafted providerRootDirectory value into arbitrary GNU tar command-line arguments, escalating to remote code execution as the builds worker process user via payloads such as --checkpoint-action=exec. The flaw is not admin-only: the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 8.7 under CVSS 4.0) reflects that a low-privileged, authenticated account with deployment-write rights over a reachable Appwrite instance is sufficient, with no user interaction and no non-default configuration required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; a vendor-released fix is available in Appwrite 2.0.0, making this a genuine high-priority issue rather than a CVSS-inflated one.
Unsafe deserialization in the opt-in kedro_datasets_experimental.pytorch.PyTorchDataset connector (kedro-datasets versions 5.0.0 through <9.5.0) allows code execution during pipeline load, because the dataset calls torch.load on .pt files without enforcing weights_only=True and silently drops user-supplied load_args, so even an explicit weights_only override never reached PyTorch. Exploitation requires a PyTorch runtime earlier than 2.6 (where weights_only defaults to False) plus a victim pipeline that loads a checkpoint obtained from an attacker-influenced shared model registry, downloaded checkpoint, or partitioned external dataset; unauthenticated remote attackers can plant the payload but must wait for that user interaction, and pipelines loading only trusted files are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation; the vendor-released patch is version 9.5.0, which enforces weights_only=True by default and correctly forwards load_args and save_args.
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overflow is reachable through the login process before authentication completes. Because the flaw is triggered during the pre-authentication login path, a remote attacker with network reachability to the management server's login/administration service needs no credentials, no user interaction, and no non-default configuration, and the resulting code execution is described as running with root privileges - consistent with the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV), but the pre-auth, root-level impact and the criticality of the management plane make this a top-priority patch target; CPE data lists the product with a wildcard version, indicating the affected version range is not bounded in the available feed data.
Arbitrary code execution in ESPnet before v.202609 is triggered when a user loads an attacker-crafted PyTorch checkpoint through any of the framework's model initialization, fine-tuning, or averaging pipelines. The root cause is CWE-502 (Deserialization of Untrusted Data): ESPnet called torch.load with weights_only=False across at least four distinct code paths, allowing pickle-embedded payloads to execute arbitrary commands with the privileges of the ESPnet process. No public exploit has been identified at time of analysis, but the attack technique - crafting malicious PyTorch pickle checkpoints - is thoroughly documented in the ML security community and requires minimal skill to reproduce.
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based buffer overflow in the ASN.1 decoder that parses VPN certificates, reachable by unauthenticated remote attackers. Because the flaw sits in the certificate-handling path of the internet-facing VPN service, a single crafted certificate or handshake can overflow heap memory and execute attacker-controlled code on security appliances that sit at the network perimeter. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, but the pre-auth network-reachable RCE profile makes it a top-tier patching priority.
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during VPN negotiation, letting a remote unauthenticated attacker run arbitrary code on the gateway itself. The CWE-295 root cause means the gateway accepts or mishandles an untrusted/forged certificate in the IKE/SSL-VPN handshake, and processing that malicious certificate leads to code execution rather than merely a trust bypass. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. No public exploit specific to this CVE has been identified at time of analysis, and it is not listed in the CISA KEV catalog, but the underlying PyYAML unsafe deserialization class is extensively documented and exploit techniques are widely known.
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
Remote code execution in Hugging Face PyTorch Image Models (timm) version 1.0.24 is triggered when a user loads a crafted model checkpoint file, exploiting unsafe deserialization of untrusted data. The vulnerability, discovered by ZDI (ZDI-CAN-27987) and tracked as ZDI-26-523, allows an attacker who can deliver a malicious checkpoint to achieve full code execution in the context of the victim's process with no special system privileges required. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the attack surface is practically significant in ML/AI workflows where downloading pretrained checkpoints from public sources is routine.
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-manager access to execute arbitrary commands on a managed SSH host prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-supplied file basenames directly to GNU tar without an end-of-options delimiter, enabling an attacker to supply filenames matching tar checkpoint options (e.g., --checkpoint=1, --checkpoint-action=exec=<cmd>) that tar interprets as directives rather than operands. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the exploitation technique is well-documented and the CVSS score of 8.8 reflects genuine high-priority risk for all pre-2.3.2 deployments.
Concurrent event manipulation during CRIU checkpointing in the Linux kernel's AMD GPU driver (drm/amdkfd) exposes a race condition leading to heap out-of-bounds writes or use-after-free memory corruption. A low-privileged local attacker on a system with an AMD GPU can exploit the unprotected gap between the event count and IDR walk in kfd_criu_checkpoint_events() by racing event creation or destruction from a second thread within the same process, producing kernel heap corruption primitives exploitable for local privilege escalation. No public exploit code and no CISA KEV entry have been identified at time of analysis; EPSS is 0.17% (6th percentile), reflecting low current adversary interest despite the high C:H/I:H/A:H CVSS impact triad.
Arbitrary code execution in Fujitsu Research's OneCompression (onecomp) Python library 1.2.0 is triggered when a victim loads a crafted PyTorch checkpoint file via the library's QuantizedModelLoader API, which unconditionally invokes Python's pickle machinery. The root cause is the hardcoded use of torch.load with weights_only=False in load_quantized_model_pt(), allowing an attacker-supplied checkpoint to embed malicious __reduce__ methods that execute arbitrary Python - including OS commands - in the context of the loading process. No public exploit code has been identified at time of analysis, though a patched version (1.2.1) is available on PyPI per the VulnCheck advisory.
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with AMD v9 GPU hardware. The MQD control stack copy uses cp_hqd_cntl_stack_size directly from hardware registers without bounding it to the allocated Buffer Object, allowing memcpy to read past the BO into adjacent GTT memory. A local low-privileged user with access to AMD GPU compute queue checkpointing can recover sensitive kernel data; no public exploit has been identified at time of analysis, though the 15% EPSS score is above baseline for kernel information-disclosure flaws.
Authentication bypass in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) lets an unauthenticated remote attacker with network access to Management services execute arbitrary commands and fully compromise the management system. It affects a broad range of releases (R80 through R82.10) including R81.20 and R82 running Jumbo Hotfix Accumulator takes at or below fixed thresholds. There is no public exploit identified at time of analysis; Check Point found the flaw internally and reports no indication of active exploitation despite the critical CVSS 4.0 score of 9.3.
Privilege escalation in CRIU allows a malicious container process to spoof credentials during checkpoint, resulting in elevated capabilities upon restore. On Red Hat platforms, effective exploitation is mitigated by mandatory access controls, user namespaces, and the requirement for privileged checkpoint initiation. No public exploit identified at time of analysis.
Authentication denial of service in Pterodactyl Panel 1.7.0–1.12.4 allows an unauthenticated remote attacker to lock out all users from login and two-factor authentication by exhausting a single shared rate-limit bucket with approximately 10 requests per minute. The attacker can sustain the lockout indefinitely, preventing legitimate access including administrative login. A proof-of-concept is publicly available, though no active exploitation has been reported via CISA KEV.
Privilege escalation in Check Point Gaia Portal allows an authenticated user holding only read-only administrative privileges to execute arbitrary commands as root, giving full compromise of the affected Quantum Security Gateway or Security Management appliance. The flaw (CWE-269, improper privilege management) is vendor-reported via advisory sk185153 and carries a CVSS 3.1 base score of 7.5 with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Check Point Quantum Security Management and Multi-Domain Security Management lets an unauthenticated remote attacker (CVSS:3.1 PR:N) run administrative commands directly on the Management Server, and potentially pivot to command execution on the managed Security Gateways it controls. It affects a broad range of releases (R77.30 through R82.10) up to specific Jumbo Hotfix Takes, but real-world exploitability hinges on the Management Server being network-reachable without firewall protection or without a restrictive Trusted Clients policy. At time of analysis there is no public exploit identified and no CISA KEV listing, so this is a high-severity but not-yet-weaponized issue.
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid application login token and log in with full administrative privileges to Quantum Security Management and Multi-Domain Security Management servers (CWE-287, CVSS 4.0 9.3). Once authenticated, the attacker can rewrite security policies and configurations across managed gateways. It is confirmed actively exploited (CISA KEV) with publicly available exploit code, though Check Point reports only a very small number of affected customers, and the EPSS score is a modest 1.07% (61st percentile), consistent with targeted rather than mass exploitation.
Local denial-of-service and out-of-bounds read in the Linux kernel F2FS filesystem allows an attacker who can mount a crafted image to panic the kernel via f2fs_recover_orphan_inodes(), which trusts an attacker-controlled orphan block entry_count. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK drives the recovery loop past the ino[] array, reading footer/adjacent data as inode numbers and tripping f2fs_bug_on(). No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV.
Filesystem metadata corruption in the Linux kernel's F2FS (Flash-Friendly File System) driver arises from a race between f2fs_need_dentry_mark() reading nat_entry flags and the concurrent checkpoint path, so a node folio can be written with the DENT_BIT_SHIFT dentry-mark set even though the inode was already checkpointed. After a sudden power-off, fsck detects this inconsistent inode state. This is a local, low-privilege integrity/availability issue with no public exploit identified at time of analysis; EPSS is low at 0.17% and it is not listed in CISA KEV.
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious checkpoint file to execute arbitrary code. The flaw lives in the _load_state routine, which imports and calls the module path named in a checkpoint's _instantiator hyperparameter, letting a crafted .ckpt bypass torch's weights_only=True safeguard when LightningModule.load_from_checkpoint is invoked. Reported by VulnCheck, it is fixed in commit d710d68 (PR #21832) via an instantiator allowlist, and publicly available exploit code exists though it is not listed in CISA KEV.
Block suppression via ZIP-244 transaction malleability in zebrad up to v4.4.1 allows a remote unauthenticated P2P peer to permanently stall a target node at a specific block height by poisoning the sent-hash cache with a validation-rejected block whose hash is never cleaned up. The root cause is that `non_finalized_block_write_sent_hashes` records a block's header hash before contextual validation completes, and on failure the stale entry remains, causing any subsequent delivery of the legitimate canonical block to be discarded as a duplicate. No active exploitation is listed in CISA KEV, but the Zcash Foundation advisory credits two independent researchers with E2E reproduction, confirming the attack is practically executable against all default configurations; vendor-released patch zebrad 4.5.0 is available.
Local information disclosure and memory corruption in the Linux kernel's AMD KFD (amdkfd) driver affects GFX11/Navi3x GPUs, where the v11 MQD manager wrongly used CP-compute checkpoint/restore handlers for SDMA queues. During a CRIU checkpoint or restore of an SDMA queue, the driver treats a 512-byte v11_sdma_mqd buffer as a 2048-byte v11_compute_mqd, so it either leaks 1536 bytes of adjacent GTT memory to userspace or overwrites 1536 bytes of neighboring GTT memory (ring buffers or adjacent MQDs). Exploitation requires local access with the ability to drive CRIU checkpoint/restore of a GPU compute process; there is no public exploit identified at time of analysis and EPSS is low (0.18%).
Local privilege escalation and information disclosure in the Linux kernel's SysV IPC subsystem stems from an unbounded ID allocation in ipc_idr_alloc() along the checkpoint/restore (CRIU) path, where a user-supplied next_id can spill past the valid ipc_mni range. Because removal truncates the index via ipcid_to_idx(), a high-index object can be freed while its real IDR slot dangles, so a subsequent /proc/sysvipc/shm walk dereferences freed memory - a use-after-free. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile) and the issue is not on CISA KEV.
Arbitrary code execution in Stanford NLP's Stanza 1.12.0 (and ≤1.12.1) occurs when the library loads a malicious PyTorch checkpoint, because its pretrain loader silently falls back from torch.load(weights_only=True) to weights_only=False whenever an UnpicklingError is raised - a condition the attacker fully controls by embedding one unsupported pickle global. Publicly available exploit code exists (working PoC in the GHSA advisory), and any developer, CI pipeline, or production NLP service that downloads Stanza model files from HuggingFace, GitHub, or a shared cache can be compromised. Fixed in Stanza 1.12.2.
Kubernetes device-plugin and resource-allocation enforcement can be bypassed in containerd by a namespace user holding pod-creation rights, who restores a container from a maliciously crafted checkpoint image. The CRI restore path trusts Container Device Interface (CDI) annotations embedded in untrusted checkpoint metadata instead of the pod's create-time spec, letting the attacker smuggle arbitrary CDI edits (host device nodes and mounts) into the restored container. It affects containerd v2.1.0-2.1.8, v2.2.0-2.2.4 and v2.3.0-2.3.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary host file disclosure in containerd's CRI plugin lets an attacker read any file on the Kubernetes node via `kubectl logs` because the plugin restores `container.log` from a checkpoint image while blindly following a symlinked path. All containerd 2.x branches before 2.1.9, 2.2.5, and 2.3.2 are affected wherever container checkpoint/restore (CRIU-based) is used. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw was independently reported by numerous researchers and a vendor patch is available.
Heap-based buffer overflow in stable-diffusion.cpp's pickle .ckpt parser allows attackers to corrupt memory and likely achieve code execution when a victim loads a maliciously crafted checkpoint file. The flaw stems from sign confusion in the BINUNICODE opcode length field, causing memcpy to be called with an attacker-controlled, effectively gigantic size derived from a negative signed integer. No public exploit identified at time of analysis, and the issue is fixed in master-584-0a7ae07.
Heap buffer overflow in the leejet stable-diffusion.cpp pickle .ckpt parser allows arbitrary code execution when a user or host application loads a maliciously crafted checkpoint file. The flaw resides in the GLOBAL opcode handler within src/model.cpp, where missing newline validation lets a -1 length value drive a heap memory copy, corrupting the heap of the diffusion inference process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the attack surface (community model-sharing sites) makes weaponization plausible.
Heap buffer overflow in stable-diffusion.cpp versions prior to master-584-0a7ae07 allows attackers to corrupt memory and potentially achieve code execution when a victim loads a malicious PyTorch .ckpt checkpoint file. The flaw resides in the SHORT_BINUNICODE opcode handler of the pickle parser in src/model.cpp, where a signed length field is mishandled and passed to memcpy. No public exploit identified at time of analysis, but the upstream fix is committed and the attack surface (untrusted model files from sharing sites) is realistic for AI/ML workloads.
Local privilege escalation in Check Point Identity Agent Full for Windows allows an authenticated local user to execute arbitrary code with SYSTEM privileges through improper executable resolution during the log collection process. The flaw is a classic CWE-427 uncontrolled search path issue, and no public exploit has been identified at time of analysis. Exploitation is constrained to attackers who already have a foothold on the endpoint but provides a reliable path to full SYSTEM compromise.
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attackers to establish Remote Access and Mobile Access VPN sessions without valid credentials by abusing a logic flaw in deprecated IKEv1 certificate validation. The flaw (CVSS 9.3, CWE-287) was reported by Check Point themselves and publicly available exploit code exists, though EPSS exploitation probability remains very low (0.01%) and the issue is not currently listed in CISA KEV. Affected deployments include multiple Quantum R80.40-R82.10 trains and Spark R80.20.X-R82.00.X firmware.
Certificate validation bypass in Check Point Quantum Security Gateway and Spark Firewalls allows network-positioned attackers to subvert IKEv1 certificate-based authentication in site-to-site VPN tunnels. A man-in-the-middle adversary can intercept or modify traffic traversing the tunnel without possessing valid credentials. No public exploit identified at time of analysis, and the issue is constrained to the deprecated IKEv1 protocol path.
Arbitrary code execution in ESA AnomalyMatch before 1.3.1 allows local attackers with low privileges to run code under the application's process by planting a malicious PyTorch checkpoint into a session directory, which is loaded via torch.load() with weights_only=False. No public exploit is identified at time of analysis, but the upstream fix (PR #9) and a third-party advisory (imlabs.info) confirm the unsafe-deserialization root cause and the migration to safetensors.
Unauthenticated information disclosure in Check Point Quantum Security Gateway allows remote attackers to read internal files on the appliance when the Identity Awareness blade is configured with Browser-Based Authentication. The flaw maps to CWE-98 (PHP file inclusion) and carries a CVSS 7.5 with confidentiality-only impact; EPSS is low (0.10%) and there is no public exploit identified at time of analysis, but the unauthenticated network reach against a perimeter gateway makes triage urgent for affected deployments.
Denial of service in Check Point Quantum Security Gateway allows remote unauthenticated attackers to crash the VPN processing service by sending specially crafted IKE packets over NAT-T (UDP/4500). Multiple supported releases (R81.10 and below, R81.20, R82, R82.10) are affected up to specific Jumbo Hotfix takes. No public exploit identified at time of analysis, and EPSS is low at 0.06% (17th percentile), suggesting limited near-term exploitation likelihood despite the 8.1 CVSS score.
Denial of service in Check Point Quantum Security Gateway allows remote unauthenticated attackers to terminate the VPN service by sending a malformed IKE fragment to UDP port 500 during the early phase of a connection attempt. The flaw affects multiple R81.x, R82, and R82.10 release trains running below specific Jumbo Hotfix Takes; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 5th percentile).
Arbitrary code execution occurs in PyTorch Lightning 2.6.0 and earlier when loading malicious checkpoint files. The LightningModule.load_from_checkpoint() method deserializes untrusted Pickle data without security restrictions, allowing attackers to execute arbitrary Python code when victims open crafted .ckpt files. EPSS score of 0.06% (19th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis. Attack requires local access and user interaction (opening a malicious checkpoint), limiting remote attack scenarios to social engineering or supply chain compromise.
Arbitrary code execution via torch-checkpoint-shrink.py script in ml-engineering project allows remote attackers to execute malicious Python code by providing crafted PyTorch checkpoint files. The vulnerability stems from insecure deserialization where torch.load() processes .pt files without the weights_only=True safeguard, enabling pickle-based arbitrary object instantiation. Despite a critical CVSS 9.8 score, EPSS probability is low (0.06%, 19th percentile) and no public exploit or active exploitation is confirmed, suggesting limited real-world targeting to date. SSVC assessment indicates total technical impact with automatable exploitation potential, making this a priority for organizations using ml-engineering scripts in production environments.
Arbitrary code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load malicious model checkpoint files through the Trainer.load() method. The vulnerability stems from unsafe PyTorch deserialization that processes untrusted Pickle objects without the weights_only security parameter. Attackers can embed malicious Python code in model files distributed through repositories, shared datasets, or social engineering campaigns. Despite the 8.8 CVSS score indicating critical severity, EPSS scoring at 0.06% (19th percentile) suggests very low real-world exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Arbitrary code execution in CosyVoice (FunAudioLLM's open-source multilingual text-to-speech toolkit) arises because its average_model.py utility calls PyTorch's torch.load() on epoch_*.pt checkpoint files without weights_only=True, allowing pickle-based deserialization of attacker-controlled objects. Any user who runs the model-averaging tool against a directory containing a malicious checkpoint executes attacker code on their machine. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), but the CWE-502 pattern is trivially weaponizable and SSVC marks it automatable.
Arbitrary code execution in the Dao-AILab flash-attention training framework (all revisions up to and including commit e724e2588cbe754beb97cf7c011b5e7e34119e62) arises because its checkpoint-loading paths call PyTorch's torch.load() without weights_only=True, permitting pickle-based deserialization of attacker-controlled objects. Any user who warmstarts or evaluates a model from an untrusted checkpoint file triggers code execution on their host. No public exploit is identified at time of analysis, EPSS is negligible (0.02%), and SSVC records exploitation as 'none' - this is a latent supply-chain/ML-artifact risk rather than an actively exploited one.
Cross-tenant Insecure Direct Object Reference (IDOR) in Aegra 0.9.0-0.9.6 allows any authenticated user to execute graph runs against other users' threads, exfiltrate full checkpoint state including conversation histories, and inject malicious messages into victims' threads by supplying known thread UUIDs to POST /threads/{thread_id}/runs endpoints. Thread IDs leak through frontend URLs, server logs, and observability traces, eliminating need for enumeration. Vendor-released patch (v0.9.7) confirmed by GitHub advisory GHSA-m98r-6667-4wq7. No active exploitation or POC identified at time of analysis, though detailed reproducer exists in issue #336.
Remote code execution in HuggingFace Transformers library allows arbitrary code execution via malicious checkpoint files. The `_load_rng_state()` method in the `Trainer` class calls `torch.load()` without the `weights_only=True` parameter, enabling deserialization attacks when PyTorch versions below 2.6 are used with torch>=2.2. An attacker can craft a malicious `rng_state.pth` checkpoint file that executes arbitrary code when loaded by an application using affected Transformers versions. The fix is available in version v5.0.0rc3, and no public exploit has been independently confirmed at time of analysis.
Directory traversal in agentic-context-engine up to version 0.7.1 enables arbitrary file writes through the checkpoint_dir parameter in OfflineACE.run, exploiting inadequate path normalization in the save_to_file method. Unauthenticated attackers can overwrite arbitrary files within the application process's permissions scope, potentially achieving code execution, privilege escalation, or application compromise depending on deployment context and file system layout.
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 76.7%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Path traversal in the Dexbotic gr00tsonic Checkpoint Loader (dexbotic/model/gr00tsonic/gr00tsonic_arch.py, function load_pretrained_gr00t) allows an attacker who controls the weight_map argument to cause file paths outside the intended checkpoint location to be used during checkpoint loading. Dexbotic 0.1 and 0.2.0 are listed as affected (CPE cpe:2.3:a:dexmal:dexbotic:*), and exploitation is remote but requires the victim to actually load an attacker-influenced pretrained checkpoint - per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L vector no authentication is needed, while passive user interaction is the primary limiting factor. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists but it is not verified as working exploit code, and the project has been notified through an issue report without a response, so the issue is assessed as low priority (monitor).
Cross-namespace data exposure in the Postgres- and SQLite-backed LangGraph stores (langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2) lets an authenticated, low-privileged caller who can influence a namespace label read, overwrite, or delete items stored under a different tenant's namespace. The stores flatten a namespace with ".".join(namespace), so a single label such as ("tenant.bob",) resolves to the same stored text as ("tenant", "bob"); only put/aput validated labels, while get, search, delete, list_namespaces, their async variants, and ops passed straight to batch/abatch accepted dotted labels unchecked. Exposure is deployment-dependent rather than universal: it requires an application that relies on namespace tuples to isolate tenants and passes untrusted input into those calls, InMemoryStore is unaffected because it compares namespace tuples, and there is no public exploit identified at time of analysis. The reported CVSS 4.0 score is 6.0, while the independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
Path traversal in Entire CLI 0.7.6 and earlier lets a collaborator who can push to the shared `entire/checkpoints/v1` branch overwrite arbitrary files on another user's machine: when the victim runs `entire session resume` or `entire checkpoint rewind`, a crafted SessionID in checkpoint metadata is used to build restore filesystem paths without validation, so attacker-controlled transcript data is written outside the expected session directory. Both the push access to the checkpoints branch and the victim's explicit invocation of resume/rewind are required, which keeps this a precondition-heavy, supply-chain-style issue rather than a drive-by exploit; no public exploit code or confirmed active exploitation has been identified at time of analysis, and notification is tracked as a moderate-priority this-month item. Successful abuse yields high integrity impact on other systems' components (scope change) and limited availability impact.
Authorization bypass in n8n's agent chat resume endpoint allows an authenticated member of a shared n8n project to read other members' private agent conversations and approve their pending tool calls, causing those tools to execute and write results back into the victim's conversation. The flaw affects n8n releases before 2.41.4 and 2.42.0 and is rooted in an insecure direct object reference (CWE-639): the resume endpoint accepts a run identifier from the request body without verifying that the referenced suspended checkpoint belongs to the caller. Exploitation requires a valid project-member account (PR:L) plus the stateful condition that another user's agent-chat checkpoint is currently suspended and awaiting tool-call approval (AT:P), so this is primarily a multi-tenant or shared-project insider risk; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed severity is moderate (CVSS 3.1 base 6.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Path traversal in MosaicML Composer 0.32.1 and earlier allows an attacker who supplies a crafted checkpoint archive to write files outside the intended extraction directory when the victim loads that checkpoint, because the tarball.extractall routine in composer/utils/checkpoint.py does not sanitize archive entry paths (CWE-22). The attack is remote and, per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P), requires only passive user interaction - someone must ingest an untrusted checkpoint, for example one pulled from a model hub, shared storage, or a supply-chain source; the independent assessment corroborates this as CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, i.e., limited integrity and availability impact with no confidentiality loss. No public exploit code was identified and the issue is not in CISA KEV, so this is a medium-severity (base 5.3) supply-chain hygiene problem rather than an actively exploited emergency; teams that only load internally generated, trusted checkpoints are not realistically exposed.
In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf_loop() call was verified on a second iteration. Consider the following verification trace: - main: bpf_loop(nr_loops, callback ...) - callback: BPF_EXIT - main: bpf_loop(nr_loops, callback ...) - ... While the first visit of the call to bpf_loop() propagated R1 precision as expected, the second call to mark_chain_precision() in the check_helper_call() set R1, but it was immediately reset when backtrack_insn() processed preceding BPF_EXIT in the loop deleted in this patch. Because of that, the second visit of the call to bpf_loop() injected checkpoint with R1 not marked as precise. Which could trick the verifier into accepting unsafe programs. See the next patch for an example of such program. Commit is structured in a way to minimize conflicts when 'bpf' would be eventually merged with 'bpf-next'.
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check check_cond_jmp_op() accepts "if rA <op> rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTR_MAYBE_NULL from rA in the corresponding branch and does not mark rB precise. Consider the following program: r0 = bpf_get_prandom_u32(); r6 = 1; /* the r6 == 0 path is explored first */ if (r0 == 0) goto 1f; r6 = 0; 1: r0 = bpf_map_lookup_elem(map, &0); /* absent, NULL at runtime */ if (r0 == r6) goto 2f; /* taken as a NULL check for r0 */ *(u8 *)(r0 + 0); /* verifier: map value; runtime: zero */ 2: return 0; The r6 == 0 path is explored first and the dereference is accepted. The r6 == 1 path is pruned at the checkpoint recorded for (1), so the comparison is never verified with a non-zero r6. At runtime a failed lookup returns NULL, NULL != 1 takes the non-NULL edge and the program dereferences a pointer that is zero.
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise. A state checkpoint reached with an imprecise zero can therefore prune a second path that reaches the store with an arbitrary nonzero scalar. The program can write attacker-controlled bits into the kptr field and load them back as a PTR_TO_BTF_ID. Call mark_chain_precision() before accepting a known-zero register. This forces state equivalence to compare its scalar range and makes the verifier visit and reject a path carrying a nonzero value.
In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag.
In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range(), the curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. Even though these in-memory curseg types are not saved in the on-disk checkpoint header, they still occupy active physical segments at runtime. If an active in-memory curseg happens to be allocated within the segment range being truncated during filesystem shrink, failing to evacuate it will cause subsequent writes to the curseg attempting out-of-bounds I/O on the truncated storage range. Fix this by expanding the curseg evacuation loop upper bound to NR_CURSEG_TYPE to ensure all active curseg types are safely migrated out of the target range.
In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_priority updates with s_umount The sysfs store path already takes s_umount for GC thread control entries, and ckpt_thread_ioprio is covered as well. critical_task_priority also updates checkpoint or GC kthread scheduling state, but it is not covered by that serialization. It can race with remount or teardown paths that are stopping those threads. Protect critical_task_priority sysfs writes with s_umount too.
In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget. If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j_list_lock. Large checkpoint lists can result in excessive lock hold times and leave other CPUs spinning on j_list_lock, causing soft lockups or RCU stalls. Pass nr_to_scan into journal_shrink_one_cp_list() and decrement it for every buffer examined, including busy buffers. Pass NULL from checkpoint cleanup paths so their existing full-list behavior is preserved. This restores the scan-budget semantics that existed before journal_shrink_one_cp_list() was changed to always scan a complete checkpoint list.
In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body. Consequently, when a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock, even when a reschedule has been requested. Large checkpoint lists under memory pressure can therefore cause long lock hold times and leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls. Route the busy-buffer path through the need_resched() check so that the shrinker can release j_list_lock and reschedule promptly, restoring parity with the clean-buffer path, which already checks need_resched(). This does not change which checkpoint buffers are eligible for removal.
HTTP response splitting and downstream desynchronization in undici's retry interceptor allows an attacker-controlled upstream server to cause downstream HTTP/1.1 clients to misinterpret response boundaries. Affected releases are undici before 6.28.1, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1. When a proxying application relays the malformed response without normalizing framing, excess bytes appended by the retry interceptor can be parsed by a downstream HTTP/1.1 peer as the start of a subsequent response, enabling response injection or session desynchronization attacks.
Arbitrary file read in Hugging Face Transformers allows an attacker who controls a model checkpoint index file to exfiltrate files from the host filesystem outside the intended model directory. The library fails to sanitize shard filenames in checkpoint index files before joining them to directory paths, meaning maliciously crafted entries containing parent-directory sequences or absolute paths resolve to unintended locations. Any user or automated pipeline that loads an attacker-supplied checkpoint - for example, by downloading a model from an untrusted Hub repository - can have host files disclosed without code execution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() During unmount, ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2_evict_inode() -> ocfs2_clear_inode() -> ocfs2_checkpoint_inode() -> ocfs2_ci_fully_checkpointed() dereferences osb->journal, causing a NULL pointer dereference. Fix this by adding a NULL check for osb->journal in ocfs2_checkpoint_inode(). If the journal is NULL, it has already been fully flushed and destroyed during shutdown, so there is nothing to checkpoint.
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafted sharded checkpoint: sensitive file disclosure via relative (../) or absolute path entries in the weight_map index, and indefinite process blocking via named pipe references enabling denial of service. A publicly available proof-of-concept exists at GitHub issue #4067, reported by VulnCheck. With no system-level privileges required (PR:N per CVSS 4.0), this is a supply chain risk for any ML practitioner who loads untrusted model checkpoints - particularly from public model registries - without needing any foothold on the target system beyond delivering the malicious checkpoint.
Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.
Unsafe deserialization in HashNeRF-pytorch's Checkpoint File Handler allows a local low-privileged attacker to achieve arbitrary code execution by supplying a malicious file via the `ckpt_path` argument to `torch.load()` in `run_nerf.py`. All commits up to 82885e698295982504eb6a26d060a6b2473e3706 are affected; a fix exists as an unmerged pull request (PR #50). A public exploit has been disclosed via GitHub issue #49, though no CISA KEV listing has been identified, indicating no confirmed widespread active exploitation at time of analysis.
Kernel denial-of-service in Zephyr RTOS v4.4.0's Dhara flash translation layer driver crashes the system during FTL disk initialization when a flash error coincides with the journal-resume checkpoint scan. The driver's dhara_nand_read/erase/prog/copy callbacks unconditionally dereference the caller-supplied err pointer, but the upstream Dhara library legitimately passes NULL during its binary search in find_last_checkblock(), triggering a NULL write and kernel fault. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; exploitation is gated on specific flash media conditions (uncorrectable ECC, bad block, or induced fault) occurring on a checkpoint page at mount time, constraining real-world risk to physical or supply-chain threat models.
Process abort in zebrad (Zcash Foundation's Rust node) up to v4.4.1 allows a malicious block producer to crash targeted nodes by submitting a child block that repeats a shielded V5 transaction from its non-finalized parent. The ordering bug in `Chain::push` causes an `assert_eq!` uniqueness check on `tx_loc_by_hash` to fire before the duplicate shielded-nullifier guard can cleanly reject the block; under Zebra's `panic = "abort"` release profile, this terminates the entire node process rather than returning a validation error. No public exploit or CISA KEV listing has been identified, but the vendor describes two concrete attack models requiring only modest mining hashrate, making targeted denial-of-service achievable in practice.
Workflow checkpoint endpoints in ComfyUI-Copilot up to 2.0.28 expose an insecure direct object reference (IDOR) flaw - the restore_workflow_checkpoint and update_workflow_ui handlers in conversation_api.py accept externally supplied version identifiers without verifying that the referenced checkpoint belongs to the requesting session, enabling an authenticated remote attacker to read workflow data owned by other sessions. The CVSS 4.0 score of 2.3 reflects limited confidentiality-only impact and high attack complexity (AC:H) due to the need to enumerate valid cross-session identifiers. A proof-of-concept is publicly available at GitHub issue #149; the upstream fix (PR #150) is pending acceptance and no patched release version has been confirmed.
Data loss in the Linux kernel's f2fs (Flash-Friendly File System) driver exposes files created and synced before any checkpoint has been written to permanent loss on sudden power off. The race condition between fsync on newly created files and concurrent checkpoint operations causes f2fs_need_inode_block_update() to misread prematurely set nat_entry flags (IS_CHECKPOINTED and HAS_LAST_FSYNC), leading fsync to skip the inode block flush it actually requires. No public exploit identified at time of analysis; the EPSS score of 0.16% at the 6th percentile reflects the narrow triggering conditions and local-only attack surface.
Checkpoint image poisoning in containerd's CRI implementation allows an attacker with pod-creation permissions to corrupt the node-local image cache, causing victim pods to silently execute malicious images in place of legitimate ones. The root cause is missing validation of image references embedded in checkpoint image configurations: containerd trusts attacker-controlled strings in the checkpoint archive to drive image pulls and local tag assignment. Subsequent pods using an IfNotPresent or Never pull policy then inherit the poisoned tag and execute arbitrary code under the victim pod's Kubernetes identity. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; vendor-released patches are available.
Unsafe deserialization in LangGraph SQLite Checkpoint's JsonPlusSerializer (versions 4.1.0 and prior) allows arbitrary Python object reconstruction from checkpoint payloads stored in a SQLite backing store, enabling code execution at checkpoint load time. Affected deployments are those where an unauthorized party can modify checkpoint bytes at rest - a high-privilege prerequisite (PR:H, AV:A per CVSS) that already implies a significant prior compromise. This is explicitly framed as a defense-in-depth concern: the issue escalates an existing 'checkpoint-store write access' incident into full application runtime code execution. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds reads in stable-diffusion.cpp's PyTorch pickle checkpoint parser (versions prior to master-584-0a7ae07) allow a crafted or truncated .ckpt file to crash the loading application or leak process memory contents. The pickle opcode handlers in src/model.cpp advanced the buffer pointer without verifying remaining bytes before each read, meaning any application using this library to load untrusted .ckpt model files is exposed to denial-of-service and potential memory disclosure. No public exploit has been identified at time of analysis, though LibFuzzer triggered crashing inputs in under one second, indicating an extremely low barrier for generating working crash payloads.
NoSQL injection in LangGraph's MongoDBSaver allows attackers to bypass thread scoping and read checkpoint data from other tenants. Vulnerable versions (<=1.3.0) of @langchain/langgraph-checkpoint-mongodb accept object-based MongoDB operators (e.g., $gt, $ne) in configurable identifier fields, leading to unauthorized cross-tenant data access. No active exploitation is confirmed (CISA KEV absent), and EPSS is very low (0.03%), but a public exploit example exists and a patch is available.
Incomplete macro-block state synchronization in Nimiq core-rs-albatross LightBlockchain allows a network-accessible attacker to permanently stall a light client's chain progression by triggering a rebranch to a fork whose tip is a macro (checkpoint or election) block. Affected are all deployments of the Rust Albatross light client prior to v1.4.0. When exploitation targets an election block specifically, the stale current_validators pointer causes every subsequent push() call to fail verify_validators(), rendering the light client unable to advance its chain. No public exploit identified at time of analysis, though the exact fix is visible in merged PR #3706 and the triggering conditions are fully described in the advisory.
Cross-domain RBAC bypass in Check Point Quantum Security Management allows an authenticated administrator with read-write access to one Management Domain (CMA) to modify Compliance Best Practices metadata stored in a separate Management Domain where they hold no permissions. The underlying root cause is SQL injection (CWE-89, corroborated by the 'SQLi' intelligence tag), suggesting the Compliance feature's metadata storage does not enforce domain-level query isolation. Affected releases span R81.10 and below, R81.20 up to Jumbo Hotfix Take 127, R82 up to Jumbo Hotfix Take 91, and R82.10 up to Jumbo Hotfix Take 19. No public exploit identified at time of analysis, and EPSS of 0.04% reflects low observed exploitation probability.
Heap-based buffer overflow in Check Point Quantum Security Gateway's HTTP-based service allows unauthenticated remote attackers to cause availability disruption by sending crafted malformed HTTP requests requiring no authentication or user interaction. Affected deployments span all R81.10 releases and below, R81.20 through Jumbo Hotfix Take 127, R82 through Jumbo Hotfix Take 91, and R82.10 through Jumbo Hotfix Take 19. No public exploit identified at time of analysis, though SSVC classifies the attack as automatable with total technical impact - a meaningful tension with the CVSS A:L rating that security teams should scrutinize before deprioritizing.