Read the docs
TI-2026-85501 Aliases CVE-2026-102739

Unsafe deserialization in ESPectre NPZ datasets allows code execution

Priority LOW 33CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

francescopace ESPectre is affected before 3.0.0-rc1. The NPZ dataset loaders in the Micro-ESPectre analysis tools enable NumPy pickle support, which is deserialization of untrusted data (CWE-502). A malicious dataset contributor or pull-request author can place an object-typed array in a .npz file, so pickle-controlled code runs as the maintainer when an analysis tool reads that field. Exploitation requires that a user run the tool.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enabled through micro-espectre/tools/csi_utils.py and a direct loader. A malicious dataset contributor or pull-request author can place an object-typed array in a .npz file under micro-espectre/data, causing pickle-controlled code to execute as the maintainer or developer when a documented analysis tool accesses the field. This issue is fixed in version 3.0.0-rc1.

Why it matters now

EPSS 0.00147 3rd percentileScored 2026-11-07
Fix Fixed espectre (francescopace): 3.0.0-rc1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
francescopaceespectrebefore 3.0.0-rc13.0.0-rc1Patch availableCNA
  • espectre Vendorfrancescopace Affected before 3.0.0-rc1 Fixed in 3.0.0-rc1 Patch available CNA

Remediation

Update francescopace ESPectre to version 3.0.0-rc1, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA espectre (francescopace) Fixed in 3.0.0-rc1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-102739
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences