---
id: "CVE-2026-24747"
kind: "vulnerability"
aliases: ["CVE-2026-24747", "GHSA-63cw-57p8-fm3p"]
title: "PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files"
severity: "high"
cvss: 8.8
epss: 0.00799
exploited: false
status: "open"
category: "package"
products: [{"name": "torch", "fixed": ["2.10.0"], "affected": "< 2.10.0", "ecosystem": "pypi"}, {"name": "linuxfoundation pytorch", "fixed": ["2.10.0"], "affected": "< 2.10.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cwe-502", "cwe-94", "ml-pipelines", "package", "python", "pytorch"]
not_affected_if: ["torch-at-2.10.0-or-later", "trusted-checkpoints-only"]
published_at: "2026-01-27T20:10:54+00:00"
first_seen_at: "2026-11-04T03:10:51+00:00"
updated_at: "2026-11-04T03:16:00+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-63cw-57p8-fm3p", "first_seen_at": "2026-11-04T03:10:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24747", "first_seen_at": "2026-11-04T03:16:00+00:00"}]
---

# PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

A crafted .pth checkpoint file loaded with torch.load(weights_only=True) can corrupt heap memory because the unpickler does not validate certain opcodes and storage sizes. An attacker who gets a user to load that file may achieve arbitrary code execution in the victim's process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:torch affected < 2.10.0 fixed 2.10.0
- vendor:linuxfoundation pytorch affected < 2.10.0 fixed 2.10.0

## How to check

- Check the installed version with `python -c "import torch; print(torch.__version__)"`
- Search code and pipelines for `torch.load(` calls that load checkpoint files from untrusted sources

## Fix

- `torch` (PyPI): move to `2.10.0` or later

## Timeline

- 2026-11-04T03:10:51+00:00 ghsa https://github.com/advisories/GHSA-63cw-57p8-fm3p
- 2026-11-04T03:16:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-24747

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/pytorch/pytorch/security-advisories/GHSA-63cw-57p8-fm3p
- [advisory] Maintainer's advisory: github.com https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p
- [fix] Release: github.com https://github.com/pytorch/pytorch/releases/tag/v2.10.0
- [poc] Exploit: github.com https://github.com/pytorch/pytorch/issues/163105

## From the sources

### Summary

A vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution.

### Vulnerability Details

The `weights_only=True` unpickler failed to properly validate pickle opcodes and storage metadata, allowing:

1. **Heap memory corruption** via `SETITEM`/`SETITEMS` opcodes applied to non-dictionary types
2. **Storage size mismatch** between declared element count and actual data in the archive

### Impact

An attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.


# Credit
Ji'an Zhou

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_