PT-2026-138418
CVE-2026-123974
·
Published
2026-11-06
·
Updated
2026-11-06
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
Found an issue in the description? Have something to add? Feel free to write us 👾