AVID-2026-R1367

Description

chidiwilliams buzz model_loader.py download_model temp file (CVE-2024-10372)

Details

A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_loader.py. The manipulation leads to insecure temporary file. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Reason for inclusion in AVID: The CVE concerns an AI-related library (buzz) used to download/load models (model_loader.py download_model). The insecure temporary file vulnerability is a software risk in the AI stack (model download/loading) that could affect model integrity or data on systems running AI workloads. It targets a dependency used in ML pipelines, thus a software supply-chain issue for general-purpose AI systems. Hardware/firmware-only issues are not implicated, and the report provides CVE, CWE, and references.

References

Affected or Relevant Artifacts

Developer: chidiwilliams
Deployer: chidiwilliams
Artifact Details:

Type	Name
System	buzz

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Base Score	4.5
Base Severity	🟠 Medium

CWE

ID	Description
CWE-377	Insecure Temporary File

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-10-25
Version: 0.3.3
AVID Entry