CVE-2026-24747

Name of the Vulnerable Software and Affected Versions PyTorch versions prior to 2.10.0

Description A flaw in the weights only unpickler of PyTorch, a Python package for tensor computation, allows a remote attacker to craft a malicious checkpoint file (.pth). When this file is loaded using the torch.load() function with the weights only=True parameter, it can lead to memory corruption and potentially enable arbitrary code execution in the context of the victim's process. The issue stems from a failure to properly validate pickle opcodes and storage metadata, which allows for heap memory corruption via SETITEM/SETITEMS opcodes applied to non-dictionary types, as well as storage size mismatches between the declared element count and the actual data in the archive.

Recommendations Update PyTorch to version 2.10.0. As a temporary mitigation, avoid loading checkpoint files from untrusted sources using the torch.load() function.