CVE-2026-102739

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102739", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T16:19:11.295Z", "datePublished": "2026-11-05T16:09:12.295Z", "dateUpdated": "2026-11-09T16:50:59.028Z"}, "containers": {"cna": {"title": "ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3"}, {"name": "https://github.com/francescopace/espectre/pull/154", "tags": ["x_refsource_MISC"], "url": "https://github.com/francescopace/espectre/pull/154"}, {"name": "https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1", "tags": ["x_refsource_MISC"], "url": "https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1"}, {"name": "https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1", "tags": ["x_refsource_MISC"], "url": "https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1"}], "affected": [{"vendor": "francescopace", "product": "espectre", "versions": [{"version": "< 3.0.0-rc1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T16:09:12.295Z"}, "descriptions": [{"lang": "en", "value": "ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enabled through micro-espectre/tools/csi_utils.py and a direct loader. A malicious dataset contributor or pull-request author can place an object-typed array in a .npz file under micro-espectre/data, causing pickle-controlled code to execute as the maintainer or developer when a documented analysis tool accesses the field. This issue is fixed in version 3.0.0-rc1."}], "source": {"advisory": "GHSA-g96x-h6rg-cqq3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:12:21.628543Z", "id": "CVE-2026-102739", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:50:59.028Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102739", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T16:12:21.628543Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:12:22.751Z"}}], "cna": {"title": "ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution", "source": {"advisory": "GHSA-g96x-h6rg-cqq3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "francescopace", "product": "espectre", "versions": [{"status": "affected", "version": "< 3.0.0-rc1"}]}], "references": [{"url": "https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3", "name": "https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/francescopace/espectre/pull/154", "name": "https://github.com/francescopace/espectre/pull/154", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1", "name": "https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1", "name": "https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enabled through micro-espectre/tools/csi_utils.py and a direct loader. A malicious dataset contributor or pull-request author can place an object-typed array in a .npz file under micro-espectre/data, causing pickle-controlled code to execute as the maintainer or developer when a documented analysis tool accesses the field. This issue is fixed in version 3.0.0-rc1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T16:09:12.295Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102739", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:50:59.028Z", "dateReserved": "2026-09-29T16:19:11.295Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T16:09:12.295Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "espectre", "vendor": "francescopace", "versions": [{"status": "affected", "version": "< 3.0.0-rc1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enabled through micro-espectre/tools/csi_utils.py and a direct loader. A malicious dataset contributor or pull-request author can place an object-typed array in a .npz file under micro-espectre/data, causing pickle-controlled code to execute as the maintainer or developer when a documented analysis tool accesses the field. This issue is fixed in version 3.0.0-rc1."}], "id": "CVE-2026-102739", "lastModified": "2026-11-12T20:07:11.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102739", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:12:21.628543Z", "version": "2.0.3"}}]}, "published": "2026-11-05T17:17:32.083", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1"}, {"source": "security-advisories@github.com", "url": "https://github.com/francescopace/espectre/pull/154"}, {"source": "security-advisories@github.com", "url": "https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1"}, {"source": "security-advisories@github.com", "url": "https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "espectre: ESPectre: Arbitrary code execution via insecure dataset deserialization", "id": "2567717", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567717"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["A flaw was found in ESPectre. The analysis tools insecurely load dataset files with Python object deserialization enabled. An attacker can supply a specially crafted dataset file containing malicious serialized data, leading to arbitrary code execution when a user or developer processes the file."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-102739", "public_date": "2026-11-05T16:09:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102739\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102739\nhttps://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1\nhttps://github.com/francescopace/espectre/pull/154\nhttps://github.com/francescopace/espectre/releases/tag/3.0.0-rc1\nhttps://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3"], "statement": "This vulnerability is rated as Important severity because insecure object deserialization can lead to arbitrary code execution with the privileges of the local user, though exploitation requires tricking a victim into opening an untrusted file. ESPectre is not packaged or distributed within any Red Hat products, so enterprise deployments are not exposed by default. Any operational risk is restricted to developer environments where third-party analysis scripts are manually invoked against unverified external data files.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.0-rc1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "espectre", "source": "cna", "vendor": "francescopace"}, "product": "espectre", "vendor": "francescopace"}], "created": "2026-11-05T17:30:19.911388+00:00", "updated": "2026-11-06T16:36:25.644944+00:00", "vendors": ["francescopace", "francescopace$PRODUCT$espectre"]}