9.8

CVE-2019-6446: fedoraproject fedora Deserialization of Untrusted Data

CVSS: 9.8v3.0CriticalModified
AliasesMGASA-2019-0322SUSE-SU-2019:0418-1SUSE-SU-2019:0419-1
Published 16-01-2019Last modified 21-07-2025
Open JSON

Vulnerability summary

CVE-2019-6446 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in fedoraproject fedora. EPSS estimates a 17.53% chance of exploitation in the next 30 days, higher than 97.1% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.0 (NVD)
EPSS score
17.53%
0%100%
Medium · +3.90 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 4
OPENSUSE-SU-2024:11243-1OPENSUSE-SU-2024:13820-1OPENSUSE-SU-2024:14311-1OPENSUSE-SU-2026:11371-1RHSA-2019:3335

Timeline

  1. 16-01-2019
    PublishedVulnerability first disclosed.
  2. 21-07-2025
    Last modifiedVulnerability information updated.

Description

An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.

CVSS metrics

5 scores · 3 sources · 3 versions

EPSS trend

Probability

17.53%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

+3.90 pp

From 13.63% on 21-09-2026

21-09-202621-10-2026
EPSS score
17.53%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • githubUnverified

    Numpy

    Maturity: poc

  • referenceUnverified

    Exploit Reference (bugzilla.suse.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse21 products
  • python-numpy_1_13_3-gnu-hpc&distro=SUSE Linux Enterprise Module for HPC 12< 1.13.3-4.9.1
  • python-numpy_1_14_0-gnu-hpc&distro=SUSE Linux Enterprise Module for HPC 15< 1.14.0-4.5.1
  • python-numpy_1_16_1-gnu-hpc&distro=SUSE Linux Enterprise Module for HPC 15< 1.16.1-4.8.1
  • python-numpy_1_16_1-gnu-hpc&distro=SUSE Linux Enterprise Module for HPC 15 SP1< 1.16.1-4.8.1
  • python-numpy_1_16_1-gnu-hpc&distro=SUSE Package Hub 15 SP1< 1.16.1-bp151.2.3.1
Redhat5 products
  • numpy< 1:1.14.3-9.el8
  • numpy-debugsource< 1:1.14.3-9.el8
  • python3-numpy< 1:1.14.3-9.el8
  • python3-numpy-debuginfo< 1:1.14.3-9.el8
  • python3-numpy-f2py< 1:1.14.3-9.el8
Opensuse4 products
  • python-numpy_1_16_1-gnu-hpc&distro=openSUSE Leap 15.0< 1.16.1-lp150.8.1
  • python-numpy_1_16_1-gnu-hpc&distro=openSUSE Leap 15.1< 1.16.1-lp151.5.3.1
  • python-numpy&distro=openSUSE Leap 15.0< 1.16.1-lp150.8.1
  • python-numpy&distro=openSUSE Leap 15.1< 1.16.1-lp151.5.3.1
Fedoraproject1 product
Mageia1 product
  • python-numpy< 1.16.3-1.mga7
Numpy1 product
PyPI1 product
  • numpy< 1.16.3 | < 1.16.1

7 vendors · 34 products

References

43 links
Show all 43 references