CVE-2026-38950 | THREATINT

Description

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.

PUBLISHED Reserved 2026-04-06 | Published 2026-06-01 | Updated 2026-06-01 | Assigner mitre

References

github.com/esa/AnomalyMatch/pull/9

imlabs.info/...tion_cve_2026_38950_ivan_markovic_052026.html

github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md

cve.org (CVE-2026-38950)

nvd.nist.gov (CVE-2026-38950)

Download JSON