Critical PyTorch Vulnerability (CVE-2026-24747) Enables Arbitrary Code Execution via Malicious Model Files A severe vulnerability in PyTorch’s checkpoint loading mechanism has been disclosed, allowing attackers to execute arbitrary code through specially crafted model files. Tracked as CVE-2026-24747 with a CVSS score of 9.8, the flaw affects PyTorch versions 2.9.1 and earlier and poses a high risk to confidentiality, integrity, and availability. The issue lies in PyTorch’s `weights_only` unpickler, which was designed to safely load model checkpoints by restricting pickle operations. However, inadequate validation of pickle opcodes and storage metadata enables attackers to bypass these protections. By embedding malicious payloads in checkpoint files (`.pth`), adversaries can trigger memory corruption exploiting SETITEM/SETITEMS opcodes on non-dictionary types or manipulating storage element counts to write beyond intended memory boundaries. When a victim loads a compromised file using `torch.load()` with `weights_only=True`, the attack executes with the user’s privileges, granting full control over the host system. Exploitation requires user interaction (loading the file) but no privilege escalation, and the attack vector is classified as network-based with low complexity, making it accessible via distributed malicious models or compromised repositories. PyTorch has patched the vulnerability in version 2.10.0, which enforces stricter validation of pickle operations and metadata. Organizations are advised to upgrade immediately, as no workarounds exist beyond avoiding untrusted checkpoint files. The flaw underscores the risks of unpickling unvalidated model files in machine learning workflows, particularly in production environments. Security teams should audit PyTorch deployments, verify model file integrity, and implement network-level controls to mitigate exposure.

A critical vulnerability in PyTorch was identified as CVE-2025-32434 that allows attackers to execute malicious code remotely. The security flaw was found in the torch.load function when used with the weights_only=True parameter, which was formerly considered a safe approach for loading models from untrusted sources. This undermines PyTorch's security recommendations, as many organizations and developers had deployed this parameter specifically for security measures. The vulnerability allows hackers to create harmful model files that, upon loading, can run arbitrary code on the victim's system leading to potential total system compromise. This becomes treacherously dangerous for machine learning pipelines that download and load models from external sources or collaborative environments automatically.