ESPnet prior to version v.202609 incorrectly deserializes pretrained model checkpoints with torch.load, leaving weights_only=False. This permissive setting allows any Python code embedded in the checkpoint to execute when the file is loaded. An attacker who supplies a malicious checkpoint can therefore run arbitrary code with the privileges of the ESPnet process. The vulnerability is a classic unsafe deserialization flaw (CWE‑502) that directly compromises confidentiality, integrity, and availability of the host system.

All releases before v.202609 are affected. The defect resides in espnet2/torch_utils/load_pretrained_model.py, line 99, which uses torch.load without restricting the deserialization context. Any system that loads pretrained models via the initialization or fine‑tuning paths is vulnerable, regardless of the terminology used for the models. Users running ESPnet on local machines or remote servers must verify that their installed version is v.202609 or newer.

The CVSS score of 8.7 reflects a high severity. The EPSS score of <1% (approximately 0.00507) indicates a very low probability of exploitation, and the vulnerability is currently absent from CISA’s KEV catalog. Exploitation requires the attacker to provide a malicious model checkpoint file that the ESPnet process will load. The likely attack vector is a local compromise where an attacker injects a crafted checkpoint, or a remote attack if the system accepts model files from untrusted sources or exposes an API that triggers the load function. The described vulnerability permits code execution with the rights of the ESPnet process, meaning full system compromise is possible if the process runs with administrative privileges.