Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-12044Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetection

Critical 9.8

In plain English

A critical-severity unsafe deserialization in open-mmlab/mmdetection from open-mmlab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 3.0)9.8Critical

Exploit odds (30 days)1.3%top 28.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A remote code execution vulnerability exists in open-mmlab/mmdetection version v3.3.0. The vulnerability is due to the use of the `pickle.loads()` function in the `all_reduce_dict()` distributed training API without proper sanitization. This allows an attacker to execute arbitrary code by broadcasting a malicious payload to the distributed training network.

Affected products (as reported)

Vendor	Product	Versions
open-mmlab	open-mmlab/mmdetection	unspecified – through latest

Weakness: CWE-502 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://huntr.com/bounties/f7e4fc32-e167-49fb-9fc7-f092b9c27e8a