CVE-2024-12044 CRITICAL

CVE-2024-12044: Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetection

Vendor Open-Mmlab
Product open-mmlab/mmdetection
Weakness CWE-502 · Unsafe deserialization
Published March 20, 2025
Last update March 20, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A remote code execution vulnerability exists in open-mmlab/mmdetection version v3.3.0. The vulnerability is due to the use of the `pickle.loads()` function in the `all_reduce_dict()` distributed training API without proper sanitization. This allows an attacker to execute arbitrary code by broadcasting a malicious payload to the distributed training network.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated