CVE-2025-3677

lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization

State: Published
Severity: 4.8 Medium
Published: Apr 16, 2025
Updated: Apr 21, 2025
Reserved: Apr 16, 2025

Description

A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem of the file fastchat/model/apply_delta.py. The manipulation leads to deserialization. An attack has to be approached locally.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-502 Deserialization
CWE-20 Improper Input Validation

Affected Products

Product	Versions
fastchatlm-sys	0.2.0Affected 0.2.1Affected 0.2.2Affected 0.2.3Affected 0.2.4Affected 0.2.5Affected 0.2.6Affected 0.2.7Affected 0.2.8Affected 0.2.9Affected 0.2.10Affected 0.2.11Affected 0.2.12Affected 0.2.13Affected 0.2.14Affected 0.2.15Affected 0.2.16Affected 0.2.17Affected 0.2.18Affected 0.2.19Affected 0.2.20Affected 0.2.21Affected 0.2.22Affected 0.2.23Affected 0.2.24Affected and 12 more versions

References

VDB-304966 | lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserializationvdb-entrytechnical-description
VDB-304966 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #552755 | lm-sys FastChat v0.2.3 to v0.2.36 Deserializationthird-party-advisory
https://github.com/lm-sys/FastChat/issues/3713issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.