{"id":"CVE-2026-24747","kind":"vulnerability","aliases":["CVE-2026-24747","GHSA-63cw-57p8-fm3p"],"related":[],"title":"PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files","description":"### Summary\n\nA vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution.\n\n### Vulnerability Details\n\nThe `weights_only=True` unpickler failed to properly validate pickle opcodes and storage metadata, allowing:\n\n1. **Heap memory corruption** via `SETITEM`/`SETITEMS` opcodes applied to non-dictionary types\n2. **Storage size mismatch** between declared element count and actual data in the archive\n\n### Impact\n\nAn attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.\n\n\n# Credit\nJi'an Zhou","summary":"A crafted .pth checkpoint file loaded with torch.load(weights_only=True) can corrupt heap memory because the unpickler does not validate certain opcodes and storage sizes. An attacker who gets a user to load that file may achieve arbitrary code execution in the victim's process.","severity":"high","cvss":8.8,"epss":0.00799,"exploited":false,"exploited_at":null,"products":[{"name":"torch","fixed":["2.10.0"],"affected":"< 2.10.0","ecosystem":"pypi"},{"name":"linuxfoundation pytorch","fixed":["2.10.0"],"affected":"< 2.10.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-502","cwe-94","ml-pipelines","package","python","pytorch"],"not_affected_if":["torch-at-2.10.0-or-later","trusted-checkpoints-only"],"how_to_check":"- Check the installed version with `python -c \"import torch; print(torch.__version__)\"`\n- Search code and pipelines for `torch.load(` calls that load checkpoint files from untrusted sources","fix":"- `torch` (PyPI): move to `2.10.0` or later","status":"open","published_at":"2026-01-27T20:10:54+00:00","first_seen_at":"2026-11-04T03:10:51+00:00","triaged_at":"2026-11-04T03:12:08+00:00","updated_at":"2026-11-04T03:16:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T03:12:08Z","model":"claude-haiku-5-5","output":{"fix":"- `torch` (PyPI): move to `2.10.0` or later","reach":"local","title":"PyTorch: malicious checkpoint files can corrupt memory and run code","impact":"high","summary":"A crafted .pth checkpoint file loaded with torch.load(weights_only=True) can corrupt heap memory because the unpickler does not validate certain opcodes and storage sizes. An attacker who gets a user to load that file may achieve arbitrary code execution in the victim's process.","audience":"developers","category":"package","nicknames":[],"who_cares":["pytorch","python","ml-pipelines"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"code runs in the victim's process after loading a file","analyst_note":"","how_to_check":"- Check the installed version with `python -c \"import torch; print(torch.__version__)\"`\n- Search code and pipelines for `torch.load(` calls that load checkpoint files from untrusted sources","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-checkpoints-only","torch-at-2.10.0-or-later"],"who_is_affected":"Any application that calls torch.load on checkpoint files that may come from outside the team, such as downloaded model weights or user uploads. Systems that only load their own trusted checkpoints are much less exposed, and the risk depends on whether an untrusted file can reach the load call.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4417,"output_tokens":524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-24747':13A,21A '-502':26B '-94':28B '1':135C '2':149C '57p8':17A '63cw':16A 'achiev':72B,178C 'actual':158C 'allow':90C,134C 'appli':143C 'arbitrari':73B,115C,179C 'archiv':162C 'attack':62B,92C,165C 'certain':56B 'checkpoint':9A,38B,97C,175C 'code':5A,74B,116C,180C 'context':184C 'convinc':168C 'corrupt':47B,109C,138C 'count':156C 'craft':36B,94C 'credit':190C 'cve':11A,19A 'cwe':25B,27B 'data':159C 'declar':154C 'detail':119C 'dictionari':147C 'element':155C 'execut':6A,75B,117C,181C 'fail':125C 'file':10A,39B,70B,98C,176C 'fm3p':18A 'get':64B 'ghsa':15A 'ghsa-63cw-57p8-fm3p':14A 'heap':48B,136C 'impact':163C 'ji':191C 'lead':113C 'linuxfoundation':23A 'load':40B,68B,102C,172C 'malici':96C,174C 'may':71B,177C 'memori':49B,110C,137C 'metadata':133C 'mismatch':152C 'ml':30B 'ml-pipelin':29B 'non':146C 'non-dictionari':145C 'opcod':57B,130C,142C 'packag':32B 'pickl':129C 'pipelin':31B 'potenti':112C 'process':80B,189C 'proper':127C 'pth':37B,99C 'python':33B 'pytorch':1A,24A,34B,85C 'remot':4A 'setitem':140C,141C 'size':60B,151C 'storag':59B,132C,150C 'summari':81C 'torch':22A 'torch.load':42B,104C 'true':45B,107C,123C 'type':148C 'unpickl':52B,89C,124C 'untrust':8A 'user':66B,170C 'valid':55B,128C 'via':7A,139C 'victim':78B,187C 'vulner':2A,83C,118C 'weight':43B,87C,105C,121C 'zhou':193C","nicknames":[],"mitigations":[],"who_affected":"Any application that calls torch.load on checkpoint files that may come from outside the team, such as downloaded model weights or user uploads. Systems that only load their own trusted checkpoints are much less exposed, and the risk depends on whether an untrusted file can reach the load call.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["linuxfoundationpytorch","pytorch","torch"],"ptokens":["linuxfoundation","pytorch","torch"],"labels":["cwe502","cwe94","high","mlpipelines","package","pypi","python","pytorch","vendor"],"campaign_type":null,"first_public_at":"2026-01-26T21:01:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":1,"sources":[{"source":"ghsa","external_id":"GHSA-63cw-57p8-fm3p","url":"https://github.com/advisories/GHSA-63cw-57p8-fm3p","severity":"high","published_at":"2026-01-27T20:10:54+00:00","modified_at":"2026-11-04T03:06:49+00:00","first_seen_at":"2026-11-04T03:10:51+00:00","fetched_at":"2026-11-04T03:10:51+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-24747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24747","severity":null,"published_at":"2026-01-27T22:15:56+00:00","modified_at":"2026-07-15T02:18:50+00:00","first_seen_at":"2026-11-04T03:16:00+00:00","fetched_at":"2026-11-04T03:16:00+00:00","note":null}],"documents":[{"id":63387,"url":"https://api.github.com/repos/pytorch/pytorch/security-advisories/GHSA-63cw-57p8-fm3p","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":63388,"url":"https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-01-26T21:01:52+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63389,"url":"https://github.com/pytorch/pytorch/releases/tag/v2.10.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":63397,"url":"https://github.com/pytorch/pytorch/issues/163105","title":"Exploit: github.com","kind":"poc","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"poc","confidence":null,"note":"Exploit: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}