CVE-2024-0654 is a medium severity insecure deserialization flaw in DeepFaceLab Pretrained Model, scored CVSS 5.3. The record lists the DeepFaceLab pretrained model DF.wf.288res.384.92.72.22. The record names no fixed version. The sections below cover how to check and what to do first.
What's affected
The record lists the DeepFaceLab pretrained model DF.wf.288res.384.92.72.22. The affected file is mainscripts/Util.py and local access is required.
The CVSS vector in the record is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, with a base score of 5.3 (Medium). KEV status: not listed in the record.
Fixed version: The record names no fixed version. Treat downloaded model files as untrusted input.
How to check if you're exposed
Check the installed version of the tool, for example under Help and About, or in your software inventory. Compare it with the version in the record. Because exploitation is local, prioritise shared workstations and build machines.
What to do now
- Find installs of the affected version.
- Move to a newer release if one exists, or stop using the tool on shared machines until one does.
- Avoid opening files or paths from sources you do not trust.
Why it matters
CWE-502 describes this class. Deserialization of untrusted data means the application rebuilds objects from input that an outsider can influence. Depending on which classes are available, that can lead to unexpected behaviour or code execution. Avoid deserializing untrusted input, and prefer plain data formats such as JSON where possible.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-18.
For a wider view, a free in-browser dependency scan and the Gold directory show where DeepFaceLab Pretrained Model sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Try it yourself
Click through it at your own pace, or open it full screen.
Local privilege and local code execution flaws are easy to underrate because they need a foothold first. In practice a foothold is often the second step of an intrusion, so these bugs decide how far an attacker can go after phishing or a stolen password. Treat them as part of defence in depth and patch them on a normal schedule, sooner on shared or high value hosts.
Quick check
Is CVE-2024-0654 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
How serious is a local only flaw?
It matters most on shared machines and where untrusted files or paths reach the tool.
Sources
- Safeguard Gold entry for CVE-2024-0654
- NVD record data for CVE-2024-0654, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
