CVE-2025-4701 MEDIUM

CVE-2025-4701: VITA-MLLM Freeze-Omni utils.py torch.load deserialization

Vendor Vita-Mllm
Product Freeze-Omni
Weakness CWE-502 · Unsafe deserialization
Published May 15, 2025
Last update May 15, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the file models/utils.py. The manipulation of the argument path leads to deserialization. It is possible to launch the attack on the local host.

Key dates

02Disclosure timeline

May 15, 2025 CVE published
May 15, 2025 Record updated