{"cve":"CVE-2024-8375","nvd":{"published":"2024-09-19T16:15:06.023","modified":"2026-06-17T08:22:27.670","status":"Analyzed","description":"There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance. Afterwards, Reverb copies the content in tensor_content to the previously mentioned pre-allocated memory, which results in the bytes in tensor_content overwriting the vtable pointers of all the objects which were previously allocated. Reverb exposes 2 relevant gRPC endpoints: InsertStream and SampleStream. The attacker can insert this stream into the server’s database, then when the client next calls SampleStream they will unpack the tensor into RAM, and when any method on that object is called (including its destructor) the attacker gains control of the Program Counter. We recommend upgrading past git commit  https://github.com/google-deepmind/reverb/commit/6a0dcf4c9e842b7f999912f792aaa6f6bd261a25","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N","score":5.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416","CWE-502"],"references":["https://github.com/google-deepmind/reverb/commit/6a0dcf4c9e842b7f999912f792aaa6f6bd261a25","https://github.com/google-deepmind/reverb/issues/141"],"products":["google:reverb"],"source":"nvd","synced_at":"2026-10-19T21:54:38.012257375+00:00"},"epss":{"cve":"CVE-2024-8375","score":0.00123,"percentile":0.02038,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w69q-w4h4-2fx8","url":"https://osv.dev/vulnerability/GHSA-w69q-w4h4-2fx8","summary":"Reverb use after free vulnerability","modified":"2026-07-13T16:42:51.420751449Z","packages":[{"ecosystem":"PyPI","name":"dm-reverb","purl":"pkg:pypi/dm-reverb","ranges":["<=0.14.0"],"fixed":[]},{"ecosystem":"PyPI","name":"dm-reverb-nightly","purl":"pkg:pypi/dm-reverb-nightly","ranges":["<=0.15.0.dev20240214"],"fixed":[]}]},{"id":"PYSEC-2026-1306","url":"https://osv.dev/vulnerability/PYSEC-2026-1306","summary":"Reverb use after free vulnerability","modified":"2026-07-13T16:42:51.420751449Z","packages":[{"ecosystem":"PyPI","name":"dm-reverb-nightly","purl":"pkg:pypi/dm-reverb-nightly","ranges":["<=0.15.0.dev20240214"],"fixed":[]}]},{"id":"PYSEC-2026-2452","url":"https://osv.dev/vulnerability/PYSEC-2026-2452","summary":"Reverb use after free vulnerability","modified":"2026-07-13T16:42:51.420751449Z","packages":[{"ecosystem":"PyPI","name":"dm-reverb","purl":"pkg:pypi/dm-reverb","ranges":["<=0.14.0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}