PyTorch versions before 2.10.0 contain a vulnerability in the weights_only unpickler used to load checkpoint files. An attacker can craft a malicious .pth checkpoint file that, when loaded with torch.load(..., weights_only=True), causes memory corruption and potentially arbitrary code execution. This vulnerability is tracked as CVE-2026-24747 and is related to deserialization of untrusted data (CWE-502). The issue is resolved in PyTorch 2.10.0. Red Hat has published advisories confirming the vulnerability and the availability of a fix. No known exploits are reported in the wild.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems by loading malicious checkpoint files. This can compromise confidentiality, integrity, and availability of the system running PyTorch. The vulnerability has a high severity rating with a Red Hat CVSS v3 base score of 8.8, indicating a significant risk if exploited.

Upgrade PyTorch to version 2.10.0 or later, where this vulnerability is fixed. Avoid loading checkpoint files from untrusted sources using torch.load with weights_only=True. No other mitigations are indicated by the vendor advisory.