OneCompression library before version 1.2.1 deserializes user‑supplied .pt checkpoint files using torch.load, which triggers Python’s pickle machinery. An attacker can embed a malicious __reduce__ method in a crafted checkpoint that will execute arbitrary Python code, including system commands, when the library loads the file. This untrusted deserialization flaw (CWE-502) enables arbitrary code execution with the privileges of the running process.

All installations of Fujitsu Research OneCompression 1.2.0 that load external checkpoint files are affected. The issue is fixed in OneCompression 1.2.1, which is available on PyPI.

The CVSS score of 8.4 indicates high severity and the EPSS score is < 1%, indicating a very low but nonzero exploitation probability. Attackers can exploit the vulnerability by providing a crafted checkpoint file to an application that uses QuantizedModelLoader.load_quantized_model_pt(), which typically requires the ability to supply or write the file to the model directory. Successful exploitation would grant the attacker full control of the application’s operating system context.