Remote Code Execution Vulnerability in Hugging Face PyTorch Image Models
CVE-2026-15679

7.8HIGH

Key Information:

Vendor

Hugging Face

Status
Pytorch Image Models
Vendor
CVE Published:
20 August 2026

What is CVE-2026-15679?

This vulnerability affects Hugging Face PyTorch Image Models, allowing attackers to execute arbitrary code via deserialization of untrusted data. The flaw arises from insufficient validation of user-supplied data during checkpoint parsing. Exploitation requires the user to visit a malicious site or open a harmful file, potentially enabling code execution within the current process context.

Affected Version(s)

PyTorch Image Models 1.0.24

References

https://www.zerodayinitiative.com/advisories/ZDI-26-523/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.