CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn 0.23.2 and other products, allows att...

Security readout for executives and security teams

This issue can crash software that uses Libsvm or scikit-learn SVM models if a crafted model is loaded. Business risk is mainly service disruption in systems that accept or import untrusted model files. The source bundle does not show active exploitation or a broad remote compromise path. Exposure is most likely in ML services, pipelines, notebooks, or products that load externally supplied SVM models through pickle, JSON, or other model persistence formats. Systems that only train and use trusted local models have lower practical exposure. Prioritize where machine-learning systems accept customer, partner, or user-provided model files. For internal-only trusted model pipelines, handle through normal patch management unless availability requirements are unusually strict. Mitigation focus: Inventory Libsvm and scikit-learn use, especially scikit-learn 0.23.2 and Libsvm v324.; Do not load SVM model files from untrusted users or unauthenticated sources.; Apply vendor updates or downstream advisories, including relevant scikit-learn and Gentoo guidance..

Prepared

Jun 5, 2026, 13:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.