CVE-2026-94093: DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization

Q: What must an attacker persuade a target to do?

A target must load manipulated serialized data through PPO.load, load_replay_buffer, or VecNormalize.load. The supplied vector indicates user interaction is required, even though the attack can be launched remotely.

Q: Are the core loading APIs protected by a safe-loading option or trust gate?

No. The affected core stable_baselines3 load APIs have no safe mode or gate, and were reported as remaining exploitable through version 2.9.0.

Q: Does the PyTorch weights_only=True change in version 2.9.0 resolve this issue?

No. That change hardened only the PyTorch tensor load path, while the unsafe pickle deserialization in the core load APIs remained. The hardening was also later reverted on master for PyTorch 1.13 compatibility.

Q: What should teams do if they cannot yet apply the outstanding hardening?

The provided data identifies no implemented workaround or safe mode for these APIs. Treat loading through PPO.load, load_replay_buffer, and VecNormalize.load as unsafe until the outstanding hardening in PR #2264 ships.

Published Sep 20, 2026

Updated

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/loadreplaybuffer/VecNormalize.load of the file saveutil.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. In v2.9.0 the PyTorch tensor load path is hardened (weightsonly=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weightsonly=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingfacesb3 package. This finding covers the core stablebaselines3 load APIs (PPO.load, loadreplaybuffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships.

Affected Software

1 affected component

stable-baselines3<=2.9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DLR-RM stable-baselines3 to a version that resolves this vulnerability.
Fixed in 2.9.0Patch #2264
Compensating control
Restrict network access to any service that exposes remote loading of models/replay buffers (e.g., endpoints that call PPO.load, PPO.load_replay_buffer, or VecNormalize.load) to prevent remote exploitation via malicious pickle deserialization.

Event History

Sep 20, 2026

CVE Published

via MITRE·10:45 PM

Data Sourced

via MITRE·10:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker persuade a target to do?

A target must load manipulated serialized data through PPO.load, load_replay_buffer, or VecNormalize.load. The supplied vector indicates user interaction is required, even though the attack can be launched remotely.

Are the core loading APIs protected by a safe-loading option or trust gate?

No. The affected core stable_baselines3 load APIs have no safe mode or gate, and were reported as remaining exploitable through version 2.9.0.

Does the PyTorch weights_only=True change in version 2.9.0 resolve this issue?

No. That change hardened only the PyTorch tensor load path, while the unsafe pickle deserialization in the core load APIs remained. The hardening was also later reverted on master for PyTorch 1.13 compatibility.

What should teams do if they cannot yet apply the outstanding hardening?

The provided data identifies no implemented workaround or safe mode for these APIs. Treat loading through PPO.load, load_replay_buffer, and VecNormalize.load as unsafe until the outstanding hardening in PR #2264 ships.

CVE-2026-94093: DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker persuade a target to do?

Are the core loading APIs protected by a safe-loading option or trust gate?

Does the PyTorch weights_only=True change in version 2.9.0 resolve this issue?

What should teams do if they cannot yet apply the outstanding hardening?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker persuade a target to do?

Are the core loading APIs protected by a safe-loading option or trust gate?

Does the PyTorch weights_only=True change in version 2.9.0 resolve this issue?

What should teams do if they cannot yet apply the outstanding hardening?