Every CVE Search/ Get API key

CVE-2026-24747

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

8.8 HighFix available

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.80%Up 0.8 points since Jan 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
CVE-2026-24747
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-502, CWE-94, CWE-502
Updated
2026-11-02
EUVDEUVD-2026-4738 8.8

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
EUVD-2026-4738
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-63cw-57p8-fm3p 8.8

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

Summary

A vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution.

Vulnerability Details

The weights_only=True unpickler failed to properly validate pickle opcodes and storage metadata, allowing:

  1. Heap memory corruption via SETITEM/SETITEMS opcodes applied to non-dictionary types
  2. Storage size mismatch between declared element count and actual data in the archive

Impact

An attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.

Credit

Ji'an Zhou

Record
GHSA-63cw-57p8-fm3p
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-94, CWE-502
Updated
2026-11-04
NVD 8.8

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
CVE-2026-24747
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-94, CWE-502
Updated
2026-11-02
OSV 8.8

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
CVE-2026-24747
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-502, CWE-94
Updated
2026-11-02
OSVDEBIAN-CVE-2026-24747 8.8

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
DEBIAN-CVE-2026-24747
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-63cw-57p8-fm3p 8.8

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

Summary

A vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution.

Vulnerability Details

The weights_only=True unpickler failed to properly validate pickle opcodes and storage metadata, allowing:

  1. Heap memory corruption via SETITEM/SETITEMS opcodes applied to non-dictionary types
  2. Storage size mismatch between declared element count and actual data in the archive

Impact

An attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.

Credit

Ji'an Zhou

Record
GHSA-63cw-57p8-fm3p
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-502, CWE-94
Updated
2026-11-04
OSVPYSEC-2026-1856 8.8

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

Summary

A vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution.

Vulnerability Details

The weights_only=True unpickler failed to properly validate pickle opcodes and storage metadata, allowing:

  1. Heap memory corruption via SETITEM/SETITEMS opcodes applied to non-dictionary types
  2. Storage size mismatch between declared element count and actual data in the archive

Impact

An attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.

Credit

Ji'an Zhou

Record
PYSEC-2026-1856
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVPYSEC-2026-2286 8.8

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
PYSEC-2026-2286
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-24747 8.8

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
UBUNTU-CVE-2026-24747
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-75293 No score

CVE-2026-24747 affecting package pytorch for versions less than 2.2.2-11

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
AZL-75293
Updated
2026-11-05
OSVAZL-75588 No score

CVE-2026-24747 affecting package pytorch for versions less than 2.0.0-14

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
AZL-75588
Updated
2026-11-02
OSVBIT-pytorch-2026-24747 No score

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Record
BIT-pytorch-2026-24747
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
torch
PyPI
 before 2.10.0
2.10.0
pytorch
Azure Linux:3
 before 2.2.2-11
2.2.2-11
pytorch
Azure Linux:2
 before 2.0.0-14
2.0.0-14
pytorch
Bitnami
 before 2.10.0
2.10.0
pytorch
Debian:12
 All versions, plus listed versions
1.13.1+dfsg-41.13.1+dfsg-52.0.1+dfsg-12.0.1+dfsg-1~exp12.0.1+dfsg-2
Show 33 moreShow less
2.0.1+dfsg-42.0.1+dfsg-52.1.2+dfsg-12.1.2+dfsg-22.1.2+dfsg-42.12.0+dfsg2-12.12.0+dfsg2-1~exp12.12.0+dfsg2-1~exp22.12.0+dfsg2-22.12.0+dfsg2-32.12.0+dfsg2-42.12.1+dfsg-12.4.1-12.4.1-32.4.1-42.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-32.5.1+dfsg-42.6.0+dfsg-12.6.0+dfsg-1~exp12.6.0+dfsg-22.6.0+dfsg-32.6.0+dfsg-42.6.0+dfsg-52.6.0+dfsg-72.6.0+dfsg-82.6.0+dfsg-92.6.0~rc9+dfsg-1~exp12.9.0+dfsg-1~exp12.9.0+dfsg-1~exp22.9.1+dfsg-1~exp12.9.1+dfsg-1~exp2
 None known
pytorch
Debian:13
 All versions, plus listed versions
2.12.0+dfsg2-12.12.0+dfsg2-1~exp12.12.0+dfsg2-1~exp22.12.0+dfsg2-22.12.0+dfsg2-3
Show 9 moreShow less
2.12.0+dfsg2-42.12.1+dfsg-12.6.0+dfsg-72.6.0+dfsg-82.6.0+dfsg-92.9.0+dfsg-1~exp12.9.0+dfsg-1~exp22.9.1+dfsg-1~exp12.9.1+dfsg-1~exp2
 None known
pytorch
Debian:14
 before 2.12.0+dfsg2-1, plus listed versions
2.12.0+dfsg2-1~exp12.12.0+dfsg2-1~exp22.6.0+dfsg-72.6.0+dfsg-82.6.0+dfsg-9
Show 4 moreShow less
2.9.0+dfsg-1~exp12.9.0+dfsg-1~exp22.9.1+dfsg-1~exp12.9.1+dfsg-1~exp2
2.12.0+dfsg2-1
torch
PyPI
 before 2.10.0, plus listed versions
1.0.01.0.11.1.01.10.01.10.1
Show 39 moreShow less
1.10.21.11.01.12.01.12.11.13.01.13.11.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.7.11.8.01.8.11.9.01.9.12.0.02.0.12.1.02.1.12.1.22.2.02.2.12.2.22.3.02.3.12.4.02.4.12.5.02.5.12.6.02.7.02.7.12.8.02.9.02.9.1
2.10.0
pytorch
PyPI
 before 2.10.0, plus listed versions
0.1.21.0.2
2.10.0
pytorch
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.7.1-71.8.1-4
 None known
pytorch
Ubuntu:25.10
 All versions, plus listed versions
2.6.0+dfsg-5build12.6.0+dfsg-7
 None known
pytorch
Ubuntu:26.10
 All versions, plus listed versions
2.9.1+dfsg-1~exp1ubuntu22.12.1+dfsg-1
 None known
pytorch
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-72.6.0+dfsg-92.9.1+dfsg-1~exp1ubuntu2
 None known

History

History
RecordedChangedSources
affected, referencesOSV
affected, facts, referencesGitHub Advisories
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24747 is a high vulnerability (CVSS 8.8) in Linuxfoundation Pytorch, published January 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in torch 2.10.0.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open