CVE-2026-112304: docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()
docTR through 1.1.0 contains an unsafe deserialization vulnerability in loadpretrainedparams() that loads checkpoints with torch.load without weightsonly=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
torchto a version that resolves this vulnerability.Fixed in 2.6 - Configuration
Load checkpoints with torch.load using weights_only=True.
docTR load_pretrained_params() weights_only = True
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any process using affected docTR versions that calls load_pretrained_params() on a checkpoint controlled by an attacker is exposed. This includes locally supplied checkpoints and checkpoints fetched from attacker-controlled URLs, when running on torch releases before 2.6.
What does an attacker need to exploit this issue?
The attacker must be able to cause the application to load a malicious checkpoint through load_pretrained_params(), either by providing a local checkpoint or controlling a URL-supplied checkpoint. Exploitation also requires user interaction, as reflected by the UI:R vector.
What is the impact if exploitation succeeds?
A malicious pickle payload in the checkpoint can execute Python code with the privileges of the process loading it. The stated impact includes high confidentiality, integrity, and availability effects.
How can I determine whether my deployment is affected?
Check whether docTR is version 1.1.0 or earlier and whether your code uses load_pretrained_params() to load checkpoints from local paths or URLs that are not fully trusted. Also determine whether the installed torch release is before 2.6.