Threat Intelligence Database

CVE-2026-4538 is a medium-severity deserialization vulnerability affecting PyTorch version 2.10.0, specifically in the pt2 Loading Handler component. The flaw allows an attacker with local access and low privileges to manipulate deserialization processes, potentially leading to limited confidentiality, integrity, and availability impacts. Exploitation does not require user interaction, and a public exploit exists, although no known attacks in the wild have been reported. The vulnerability is constrained to local environments, reducing remote exploitation risk. PyTorch maintainers have been informed but have not yet released a patch. Organizations using PyTorch 2.10.0 should be cautious, especially in environments where untrusted local users have access.

HighVulnerabilityUnited StatesChinaGermany+7#cve#cve-2026-4538#gcve

An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (DoS).

In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.

UnknownVulnerabilityUnited StatesChinaIndia+7#cve#cve-2024-48063#gcve