This vulnerability in h2oai h2o-3 (up to version 7402) affects the importBinaryModel function located in h2o-core/src/main/java/hex/Model.java within the JAR Handler component. It allows remote attackers to perform deserialization attacks by manipulating input to this function. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and low impacts on confidentiality, integrity, and availability. The vendor has not provided a patch or remediation guidance, and the exploit code is publicly available.

Successful exploitation could allow remote attackers to execute arbitrary deserialization processes, potentially leading to unauthorized code execution or other impacts on the affected system's integrity, confidentiality, and availability. The CVSS score of 6.9 reflects a medium severity risk with low impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported beyond the public release of exploit code.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying workarounds such as disabling or restricting access to the importBinaryModel function or limiting network exposure of the affected service until an official fix is available.