PyTorch vulnérable à l'exécution de code à distance via des fichiers de checkpoint non fiables

The impact of this vulnerability is significant. Successful exploitation allows an attacker to execute arbitrary code on the system running the PyTorch application. This could lead to complete system compromise, data theft, or denial of service. The weights_only=True loading option, intended for efficient model deployment, introduces a deserialization vulnerability that can be exploited to overwrite memory regions. Attackers could potentially inject malicious code into the process, gaining control over the application and potentially the underlying system. The ease of crafting malicious checkpoint files, coupled with the widespread use of PyTorch in machine learning applications, increases the potential attack surface.

Organizations and individuals using PyTorch for machine learning development and deployment are at risk, particularly those relying on the weights_only=True loading option for model efficiency. Shared hosting environments where multiple users can upload and load models are especially vulnerable.

• python / system: Monitor for unusual memory access patterns during .pth file loading using memory profiling tools. • python / application: Implement logging around torch.load calls to track file sources and loading parameters. • generic web: If PyTorch models are served via a web application, monitor for suspicious file uploads or requests for .pth files. • generic web: Check access logs for requests containing .pth extensions, especially from untrusted sources.

1. 2026-01-27Disclosure

   disclosure

1. Réservé2026-01-26
2. Publiée2026-01-27
3. Modifiée2026-02-26
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-24747 is to upgrade to PyTorch version 2.10.0 or later, which contains the fix. If upgrading is not immediately feasible, consider restricting access to the torch.load function and carefully validating the source of any .pth files before loading them. Implement strict input validation and sanitization to prevent the loading of untrusted checkpoint files. While a WAF is unlikely to directly address this vulnerability, it can help prevent the upload of malicious .pth files. There are no specific Sigma or YARA rules readily available for this vulnerability, but monitoring for unusual memory access patterns during .pth file loading could be a potential detection strategy.