PT-2025-17312 · Pytorch+1 · Pytorch+1

Azraelxuemo · Published 2024-11-07 · Updated 2025-12-26 · CVE-2025-32434

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PyTorch versions prior to 2.6.0 PyTorch ≤2.5.1

Description PyTorch is vulnerable to a Remote Command Execution (RCE) vulnerability. This flaw exists in versions 2.5.1 and prior, specifically when loading a model using the torch.load() function with the weights only=True parameter. Despite being previously considered a safe practice, loading models with this configuration can now lead to arbitrary code execution. The vulnerability allows attackers to craft malicious model files that can execute code on the victim system. The torch.load() function, when used with weights only=True, is susceptible to exploitation due to insecure deserialization. This vulnerability has a CVSS score of 9.3 and is considered critical.

Recommendations Upgrade to PyTorch version 2.6.0 or later to address this vulnerability. As an interim measure, avoid using torch.load() with external files and implement additional verification of model content.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

AZL-60877

AZL-60880

BDU:2025-04916

BIT-PYTORCH-2025-32434

CVE-2025-32434

DLA-4389-1

GHSA-53Q9-R3PM-6PQ6

PYSEC-2025-41

Affected Products

Debian

Pytorch

References · 65

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32434.json · Exploit
• https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-53q9-r3pm-6pq6 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-32434 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32434 · Security Note
• https://bdu.fstec.ru/vul/2025-04916 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32434 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pytorch-2025-32434 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-41 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60880 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60877 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-32434 · Vendor Advisory
• https://github.com/pytorch/pytorch · Note
• https://github.com/pytorch/pytorch/commit/8d4b8a920a2172523deb95bf20e8e52d50649c04 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-41.yaml · Note