CVE-2025-32434

PyTorch contains a Remote Command Execution (RCE) vulnerability in versions 2.5.1 and earlier when loading a model with torch.load and weights_only=True. The issue is publicly documented and has been patched in version 2.6.0. External notices reiterate that upgrading to 2.6.0+ mitigates the flaw;...

CVE-2026-24747

PyTorch prior to v2.10.0 is vulnerable to memory corruption and potential arbitrary code execution via the weights_only unpickler when loading a malicious .pth checkpoint with torch.load(..., weights_only=True). Affected software is PyTorch (Python tensor computation package); the issue is fixed ...

CVE-2024-31580

PyTorch versions before v2.2.0 contain a heap buffer overflow vulnerability in the /runtime/vararg_functions.cpp component. This flaw allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted input. Several products are impacted, including IBM Watson Machine Lea...

CVE-2024-31584

Pytorch versions prior to v2.2.0 are vulnerable to an Out-of-bounds Read flaw located in the torch/csrc/jit/mobile/flatbuffer_loader.cpp component. A remote attacker could exploit this by sending a specially crafted request to cause a denial of service condition. This vulnerability specifically a...

CVE-2022-45907

CVE-2022-45907 is a PyTorch vulnerability where torch.jit.annotations.parse_type_line uses eval unsafely, enabling arbitrary code execution. Documented impact is high (CRITICAL, CVSS 3.1/3.0 vectors with 9.8 base score). Affected IBM products include Watson Studio for Cloud Pak for Data (versions...

CVE-2024-31583

PyTorch versions prior to v2.2.0 contain a use-after-free vulnerability in the torch/csrc/jit/mobile/interpreter.cpp component. This flaw can lead to a denial of service (DoS) condition or potentially allow for arbitrary code execution , as reported by some sources. The vulnerability affects seve...