Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Tencent FaceDetection-DSFD allows attacker code execution

CVE-2025-13715 · published 10 months ago
Summary

The FaceDetection-DSFD product from Tencent can be tricked into running harmful code if a user visits a malicious web page or opens a crafted file. The problem is that the software processes incoming data without checking it first, giving an attacker the ability to execute commands with full system privileges. Install any patches released by Tencent, keep the software up to date, and avoid opening unknown links or files while the program is running.

Original advisory text
Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability
Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent FaceDetection-DSFD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the resnet endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27197.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published23 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-13715 · NVD
CVE-2025-13715 · OSV
Track software like this
Free during beta