Vulnerability GHSA-63cw-57p8-fm3p
High Risk
HIGH RISK
CVSS Score: 8.8
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
9 months ago
January 27, 2026 at 08:10 PM UTC
PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
1.0.0 - 2.9.1
1.0.0 - 2.9.1
Summary
PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
Details
Summary
A vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution.
Vulnerability Details
The weights_only=True unpickler failed to properly validate pickle opcodes and storage metadata, allowing:
- Heap memory corruption via
SETITEM/SETITEMSopcodes applied to non-dictionary types - Storage size mismatch between declared element count and actual data in the archive
Impact
An attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.
Credit
Ji'an Zhou
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
3 months ago
PyTorch Improper Resource Shutdown or Release vulnerability
1.0.0 - 2.7.1 PYSEC-2026-1970
1.0.0 - 2.7.1 PYSEC-2026-1970
High Risk
7 months ago
No summary available
1.0.0 - 2.10.0 PYSEC-2026-139
1.0.0 - 2.10.0 PYSEC-2026-139
High Risk
9 months ago
No summary available
1.0.0 - 2.9.1 PYSEC-2026-2286
1.0.0 - 2.9.1 PYSEC-2026-2286
Low Risk
11 months ago
No summary available
1.0.0 - 2.5.0 PYSEC-2025-210
1.0.0 - 2.5.0 PYSEC-2025-210
High Risk
1 year ago
No summary available
1.0.0 - 2.7.0 PYSEC-2025-209
1.0.0 - 2.7.0 PYSEC-2025-209
Impacted packages
Timeline
Published
9 months ago
January 27, 2026 at 08:10 PM UTC
Fixed (2.10.0)
8 months ago
February 10, 2026 at 09:44 PM UTC
Last Modified
7 hours ago
November 04, 2026 at 03:15 AM UTC