PyTorch’s weights_only unpickler allows a maliciously crafted .pth file to corrupt memory and potentially trigger arbitrary code execution when loaded with torch.load(..., weights_only=True). The flaw is an unsafe deserialization vulnerability, as reflected by CWE-502 and an underlying limitation of the unpickling engine, CWE-94.

All installations of PyTorch older than version 2.10.0 are vulnerable, including those distributed by the Linux Foundation. Users who import the PyTorch package and load checkpoint files with the weights_only=True flag are at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. Although the EPSS score is less than 1%, indicating a low current likelihood of widespread exploitation, the potential impact warrants prompt remediation. The issue is not yet listed in the CISA KEV catalog. The attack can occur when a malicious checkpoint file is supplied to the application; the most likely vector is remote input over any channel that delivers the .pth file to the target system, such as file sharing, network transfer, or artifact deployment. This inferred vector comes from the description that the file can be supplied by an attacker and the required torch.load operation.