CVE-2025-32434

PyTorch contains a Remote Command Execution (RCE) vulnerability in versions 2.5.1 and earlier when loading a model with torch.load and weights_only=True. The issue is publicly documented and has been patched in version 2.6.0. External notices reiterate that upgrading to 2.6.0+ mitigates the flaw;...

CVE-2026-24747

PyTorch prior to v2.10.0 is vulnerable to memory corruption and potential arbitrary code execution via the weights_only unpickler when loading a malicious .pth checkpoint with torch.load(..., weights_only=True). Affected software is PyTorch (Python tensor computation package); the issue is fixed ...

CVE-2024-31584

Pytorch versions before v2.2.0 are vulnerable to an Out-of-bounds Read flaw within the torch/csrc/jit/mobile/flatbuffer_loader.cpp component. The root cause is a missing validation for the mobile_ivalue_size_ variable against the ivalues->size() in the FlatbufferLoader::parseModule function, w...

CVE-2022-45907

CVE-2022-45907 is a PyTorch vulnerability where torch.jit.annotations.parse_type_line uses eval unsafely, enabling arbitrary code execution. Documented impact is high (CRITICAL, CVSS 3.1/3.0 vectors with 9.8 base score). Affected IBM products include Watson Studio for Cloud Pak for Data (versions...

CVE-2024-31580

PyTorch versions prior to v2.2.0 are vulnerable to a heap buffer overflow in the /runtime/vararg_functions.cpp component. This flaw allows an attacker to cause a Denial of Service (DoS) by providing a crafted input. Impacted products include Watson Machine Learning on Cloud Pak for Data (versions...

CVE-2024-31583

The machine learning framework PyTorch (versions prior to v2.2.0 ) is vulnerable to a use-after-free flaw in the torch/csrc/jit/mobile/interpreter.cpp component. An attacker could exploit this by persuading a victim to open specially crafted content, potentially leading to arbitrary code executio...