This vulnerability affects the importBinaryModel function in the h2o-core/src/main/java/hex/Model.java file of h2oai h2o-3 up to version 7402. It involves insecure deserialization that can be triggered remotely, potentially allowing attackers to manipulate the deserialization process. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor has not provided any advisory or patch, and no official remediation level is stated. Public exploits exist, but there is no confirmation of exploitation in the wild.

Successful exploitation could allow remote attackers to manipulate deserialization in the affected component, potentially leading to unauthorized actions or code execution depending on the deserialization context. The CVSS vector indicates no privileges or user interaction are required, but the impact on confidentiality, integrity, and availability is limited to low. The lack of vendor response and public exploit availability increases risk exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor advisory is available, users should consider restricting access to the vulnerable functionality and monitor for any updates from the vendor. Applying network-level controls to limit exposure of the affected service may reduce risk until a patch is released.