Read the docs
TI-2024-33495 Aliases CVE-2024-50050GHSA-2m97-q37r-gwpc

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a…

Priority LOW 32Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00873 59th percentileScored 2026-11-07
Fix Fixed Llama Stack (Meta Platforms, Inc): 7a8aa775e5a267cf8660d83140011a0b7f91e005

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Meta PlatformsLlama Stackbefore 7a8aa775e5a267cf8660d83140011a0b7f91e0057a8aa775e5a267cf8660d83140011a0b7f91e005Patch availableCNA
  • Llama Stack VendorMeta Platforms Affected before 7a8aa775e5a267cf8660d83140011a0b7f91e005 Fixed in 7a8aa775e5a267cf8660d83140011a0b7f91e005 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:meta_platforms_inc:llama_stack:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:meta_platforms_inc:llama_stack:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA Llama Stack (Meta Platforms, Inc) Fixed in 7a8aa775e5a267cf8660d83140011a0b7f91e005

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-50050
  2. 2026-10-03 Alias added: GHSA-2m97-q37r-gwpc

References

Other 1

  • TI-2025-34672 An integer overflow vulnerability in the loading of ExecuTorch models can cause… CVSS 3.1CRITICAL 9.8
  • TI-2025-34671 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
  • TI-2025-34670 Out-of-bounds read in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
  • TI-2025-34669 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
  • TI-2025-21707 Integer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
  • TI-2025-21706 Integer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences