Live › vulnerability › CVE-2026-24747
A crafted .pth checkpoint file loaded with torch.load(weights_only=True) can corrupt heap memory because the unpickler does not validate certain opcodes and storage sizes. An attacker who gets a user to load that file may achieve arbitrary code execution in the victim's process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:10 UTC, 0h before NVD. All times on this page are UTC.
Any application that calls torch.load on checkpoint files that may come from outside the team, such as downloaded model weights or user uploads. Systems that only load their own trusted checkpoints are much less exposed, and the risk depends on whether an untrusted file can reach the load call.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| torch | pypi | < 2.10.0 | 2.10.0 |
| linuxfoundation pytorch | vendor | < 2.10.0 | 2.10.0 |
python -c "import torch; print(torch.__version__)"torch.load( calls that load checkpoint files from untrusted sourcestorch (PyPI): move to 2.10.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution.
The weights_only=True unpickler failed to properly validate pickle opcodes and storage metadata, allowing:
SETITEM/SETITEMS opcodes applied to non-dictionary typesAn attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.
Ji'an Zhou
This page as .md · .json · in your agent: get_signal("CVE-2026-24747")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.