CVE-2026-10043: MosaicML Composer Checkpoint Deserialization RCE Vulnerability

Technical summary

CVE-2026-10043 is a CWE-502 (Deserialization of Untrusted Data) vulnerability in MosaicML Composer's checkpoint parsing logic. The vulnerability stems from insufficient validation of user-supplied serialized data during checkpoint loading. When an attacker-controlled checkpoint is deserialized, it can result in remote code execution within the application's process context. The CVSS 3.0 vector CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects local attack surface, low complexity, no privilege requirement, required user interaction, and full compromise of confidentiality, integrity, and availability. The vulnerability was reported to Trend Micro's Zero Day Initiative as ZDI-CAN-27990.

Business impact

Successful exploitation could allow an attacker to execute arbitrary code on systems running MosaicML Composer, potentially leading to data theft, model poisoning, lateral movement, or service disruption. Data science and ML teams using Composer for model training and checkpointing are at risk if they download or open checkpoints from untrusted sources. The required user interaction lowers immediate organizational risk but increases the attack surface for social engineering or supply-chain scenarios where malicious checkpoints are distributed as seemingly legitimate training artifacts.

Affected systems

MosaicML Composer installations are affected. Verify the specific version range and affected products against the vendor advisory, as the ground-truth data does not specify version constraints. Any system or user account running Composer and loading checkpoint files is a potential target.

Exploitability

Exploitation requires user interaction: the victim must open or load a malicious checkpoint file. There is no evidence of public exploit code or active exploitation in the wild. The vulnerability is not on the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is local (file-based), but distribution of malicious checkpoints via email, cloud repositories, or collaborative platforms could lower the practical barrier to social engineering attacks in data science workflows.

Remediation

Apply the security patch provided by MosaicML as soon as it becomes available. Until patching is feasible, enforce strict controls on checkpoint sources: only load checkpoints from trusted internal repositories or verified collaborators, and implement code review or scanning practices for checkpoint integrity. Educate ML engineers and data scientists on the risks of loading checkpoints from untrusted external sources.

Patch guidance

Monitor MosaicML's security advisories and release notes for patched versions of Composer. Verify the specific patch version against the vendor advisory before deployment. Test patches in a non-production environment to ensure compatibility with your training pipelines. Coordinate patching with your ML operations team to minimize disruption to ongoing training jobs.

Detection guidance

Monitor for unusual deserialization activity or process spawning when Composer loads checkpoints. Log all checkpoint loading operations and their sources. Implement file integrity monitoring on checkpoint directories and repositories. Network-based detection is limited due to the local attack vector; focus on endpoint-level logging of process execution, file access, and Python deserialization library calls. Look for suspicious checkpoint files being loaded from unexpected sources or with unusual metadata.

Why prioritize this

Although rated HIGH severity and requiring user interaction, this vulnerability poses significant risk to ML development environments where checkpoint sharing is common. Data science teams often exchange model artifacts with peers, collaborators, and external partners, creating multiple pathways for social engineering. The combination of high impact (full code execution) and moderate exploitability (user-driven) warrants prompt patching, especially for organizations handling sensitive data or models.

Risk score, explained

The CVSS 3.0 score of 7.8 (HIGH) reflects the critical impact of successful exploitation (confidentiality, integrity, and availability fully compromised) balanced against the requirement for local attack surface and user interaction. The score appropriately captures the severity of arbitrary code execution while acknowledging that exploitation is not automatic or remotely triggered without user involvement. Organizations should treat this as a high-priority patch candidate, particularly if they share checkpoints externally or operate in collaborative environments.

Frequently asked questions