Arbitrary Code Execution Vulnerability in PyTorch Before Version 2.10.0
CVE-2026-24747

8.8HIGH

Key Information:

Vendor

Pytorch

Status
Pytorch
Vendor
CVE Published:
27 January 2026

What is CVE-2026-24747?

A vulnerability exists in PyTorch that affects the weights_only unpickler, allowing attackers to create a malicious checkpoint file (.pth). When this file is loaded using torch.load(..., weights_only=True), it can corrupt memory, posing a risk of arbitrary code execution. This issue has been resolved in version 2.10.0. It is critical for users to upgrade to this version to safeguard their systems against possible exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

pytorch < 2.10.0

References

https://github.com/pytorch/pytorch/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pytorch/pytorch/issues/163105
x_refsource_MISC
https://github.com/pytorch/pytorch/163122/commit/954dc518...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.