Vulnerability PYSEC-2026-2286
High Risk
HIGH RISK
CVSS Score: 8.8
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
9 months ago
January 27, 2026 at 10:15 PM UTC
No summary available
1.0.0 - 2.9.1
1.0.0 - 2.9.1
Details
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
3 months ago
PyTorch Improper Resource Shutdown or Release vulnerability
1.0.0 - 2.7.1 PYSEC-2026-1970
1.0.0 - 2.7.1 PYSEC-2026-1970
High Risk
7 months ago
No summary available
1.0.0 - 2.10.0 PYSEC-2026-139
1.0.0 - 2.10.0 PYSEC-2026-139
High Risk
9 months ago
PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
1.0.0 - 2.9.1 GHSA-63cw-57p8-fm3p
1.0.0 - 2.9.1 GHSA-63cw-57p8-fm3p
Low Risk
11 months ago
No summary available
1.0.0 - 2.5.0 PYSEC-2025-210
1.0.0 - 2.5.0 PYSEC-2025-210
High Risk
1 year ago
No summary available
1.0.0 - 2.7.0 PYSEC-2025-209
1.0.0 - 2.7.0 PYSEC-2025-209
Impacted packages
Timeline
Published
9 months ago
January 27, 2026 at 10:15 PM UTC
Fixed (2.10.0)
8 months ago
February 10, 2026 at 09:44 PM UTC
Last Modified
3 months ago
July 13, 2026 at 07:26 AM UTC