CVE-2024-37057 is a deserialization vulnerability affecting MLflow platform versions from 2.0.0 up to and including 2.14.1. The issue arises when untrusted data, specifically a maliciously uploaded Tensorflow model, is deserialized by the platform. This can lead to arbitrary code execution on the end user's system upon interaction with the model. No CVSS score is provided, but the impact is considered high given the nature of code execution risks. There is no information about available patches or vendor advisories in the provided data. The platform is not a cloud service, so remediation responsibility lies with the user or administrator.

Successful exploitation allows an attacker to execute arbitrary code on the system of an end user who interacts with a malicious Tensorflow model uploaded to the MLflow platform. This can lead to full system compromise depending on the privileges of the user running the platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid interacting with untrusted Tensorflow models uploaded to MLflow. Monitor vendor channels for updates and apply patches promptly once released.