PT-2025-17312 · Pytorch +1 · Pytorch +1

Azraelxuemo

·

Published

2024-11-07

·

Updated

2025-07-16

·

CVE-2025-32434

CVSS v2.0
10
VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

**Name of the Vulnerable Software and Affected Versions:**

PyTorch versions prior to 2.6.0

**Description:**

PyTorch, a Python package for tensor computation and deep neural networks, is affected by a Remote Command Execution (RCE) vulnerability. This vulnerability exists when loading a model using the `torch.load()` function with the `weights only=True` parameter. Exploitation of this vulnerability allows attackers to execute arbitrary code on the system.

**Recommendations:**

PyTorch versions prior to 2.6.0 are vulnerable and should be updated to version 2.6.0 or later to address this issue. As an interim measure, avoid using `torch.load()` with the `weights only=True` parameter and implement additional verification of model files.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-04916
BIT-PYTORCH-2025-32434
CVE-2025-32434
GHSA-53Q9-R3PM-6PQ6
PYSEC-2025-41

Affected Products

Debian
Pytorch