AZL-60880 CVE-2025-32434 affecting package pytorch for versions less than 2.0.0-8

🗓️ 18 Apr 2025 16:15:23Reported by GoogleType

osv🔗 osv.dev👁 9 Views

PyTorch remote code execution when loading models with weights_only=True in versions before 2.6.0; fixed in 2.6.0.

Reporter	Title	Published	Views	Family All 49
IBM Security Bulletins	Security Bulletin: There is a vulnerablity in the torch library affecting IBM watsonx Code Assistant On Prem	19 Jun 202514:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	18 Jul 202609:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses Torch - 2.3.1+cu121 which is vulnerable to CVE-2025-32434	3 Aug 202608:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Remote Command Execution in PyTorch [CVE-2025-32434]	28 Aug 202515:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses torch - 2.2.0+cpu which is vulnerable to CVE-2025-32434.	5 Dec 202505:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses WebSphere Application Server Liberty which is affected by cross-site scripting and vulnerable to CVE-2025-32434.	30 Mar 202611:47	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Linuxfoundation Pytorch	30 Jun 202620:00	–	githubexploit
Tenable Nessus	Azure Linux 3.0 Security Update: pytorch (CVE-2025-32434)	6 May 202500:00	–	nessus
Tenable Nessus	Debian dla-4389 : libtorch-dev - security update	3 Dec 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: pytorch (CVE-2025-32434)	6 May 202500:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-32434

21 Apr 2026 04:37Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.8

EPSS0.0194