A flaw in the importBinaryModel method of the Model.java file within the h2o-core component allows an attacker to supply a crafted binary model file that is deserialized by the application. Because deserialization of untrusted data is performed without sufficient validation, an attacker could trigger arbitrary code execution on the host running the H2O AI service. The CVSS score of 6.9 indicates a moderate severity level, and the availability of a public exploit suggests that an attacker could create a malicious model and attempt to load it over the network. The primary impact is the ability for a remote attacker to alter the integrity of the application or execute arbitrary code within the host process.

Affected systems include the h2oai h2o-3 product, specifically versions up to and including 7402. The vulnerability resides in the JAR handler component that processes incoming model files. Any deployment of this product prior to removing the vulnerability, regardless of the operating environment, requires remediation.

The risk is moderate to high when the application is exposed to remote connections that accept model uploads. Although the EPSS score is not available, the fact that the exploit has been publicly released and is listed in multiple vulnerability databases increases the likelihood of exploitation. As the vulnerability is not present in the CISA KEV catalog, no known publicly confirmed exploit activity has been reported by CISA, yet the available exploit code and the remote attack vector mean that systems should treat the issue as already exploited in the wild. A defensive posture requires patching or limiting the import capability.