CVE-2026-24747: PyTorch Remote Code Execution via Malicious Checkpoint Files
Summary
CVE-2026-24747: PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files. Affects pytorch versions < 2.10.0. Fixed in 2.10.0. How to fix ↓
Also tracked for
The same CVE-2026-24747 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyTorch is an open-source machine learning library widely used for applications such as computer vision and natural language processing. It provides a flexible and dynamic computational graph, enabling developers to build complex neural networks with ease. However, a vulnerability in its checkpoint loading mechanism poses a significant risk, allowing attackers to execute arbitrary code through untrusted checkpoint files.
Vulnerability Detail
The vulnerability arises from the weights_only unpickler in PyTorch, which fails to adequately validate pickle opcodes and storage metadata. This oversight allows attackers to craft malicious checkpoint files (.pth) that, when loaded with torch.load(..., weights_only=True), can lead to heap memory corruption and arbitrary code execution. Specifically, the unpickler's mishandling of SETITEM and SETITEMS opcodes on non-dictionary types, along with potential storage size mismatches, creates a pathway for exploitation.
How To Fix
Minimum fixed version
2.10.0
This is the first release that contains the fix.
pip install --upgrade "pytorch==2.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid loading checkpoint files from untrusted sources. If you must load such files, consider using a different method that does not involve the weights_only parameter, or validate the contents of the checkpoint file before loading.
Conclusion
The vulnerability identified as CVE-2026-24747 in PyTorch poses a significant risk due to its potential for remote code execution through malicious checkpoint files. Users are strongly advised to update to the latest version of PyTorch to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for pytorch →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring signup.
The vulnerability specifically involves malicious checkpoint files with a .pth extension that can be loaded using PyTorch's torch.load function.
If exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the victim's process, leading to severe security breaches.
While updating is the best solution, you can mitigate risks by avoiding loading checkpoint files from untrusted sources and validating their contents before use.
References
Related vulnerabilities
Recent vulnerabilities recorded for pytorch.
