The OneCompression library 1.2.0 by Fujitsu Research is vulnerable to unsafe deserialization due to the use of torch.load with weights_only=False in the QuantizedModelLoader.load_quantized_model_pt() method. This causes Python's pickle machinery to deserialize data from a model.pt checkpoint file without validation, allowing attackers to embed malicious __reduce__ methods. When the library loads this crafted checkpoint from a user-supplied model directory, arbitrary Python code execution, including system commands, can occur. The vulnerability is identified as CVE-2026-73325 with a CVSS 4.0 score of 8.4 (high severity). No official patch or remediation guidance is currently available.

Successful exploitation allows an attacker to execute arbitrary Python code on the system running the vulnerable OneCompression 1.2.0 library by supplying a malicious model checkpoint file. This can lead to system compromise or execution of arbitrary system commands. The attack requires user interaction to load the crafted file and local access to supply the malicious checkpoint.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid loading untrusted or unauthenticated model.pt checkpoint files with the vulnerable OneCompression 1.2.0 library. Restrict access to directories from which model files are loaded and validate or sandbox the loading process where possible.