CVE-2026-24747: PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
Summary
A vulnerability in PyTorch's weightsonly unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weightsonly=True), can corrupt memory and potentially lead to arbitrary code execution.
Vulnerability Details
The weightsonly=True unpickler failed to properly validate pickle opcodes and storage metadata, allowing:
1. Heap memory corruption via SETITEM/SETITEMS opcodes applied to non-dictionary types 2. Storage size mismatch between declared element count and actual data in the archive
Impact
An attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.
Credit Ji'an Zhou
Other sources
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weightsonly unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weightsonly=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pytorchto a version that resolves this vulnerability.Fixed in 2.10.0 - Upgrade
Upgrade
PyTorchto a version that resolves this vulnerability.Fixed in 2.10.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24747?
CVE-2026-24747 has a high severity due to its potential for remote code execution.
How do I fix CVE-2026-24747?
To mitigate CVE-2026-24747, update to a patched version of PyTorch that addresses this vulnerability.
What versions of PyTorch are affected by CVE-2026-24747?
CVE-2026-24747 affects versions of PyTorch prior to 2.10.0.
What type of attacks can CVE-2026-24747 enable?
CVE-2026-24747 can enable remote code execution through malicious checkpoint files.
Is CVE-2026-24747 related to any specific functionality in PyTorch?
Yes, CVE-2026-24747 is specifically related to the `weights_only` unpickler function in PyTorch.