A critical deserialization flaw in PyTorch allows unauthenticated attackers to trigger arbitrary code execution by providing a crafted checkpoint file to the torch.load function.

This vulnerability involves improper deserialization of untrusted data (CWE-502) within the weights_only unpickler. An attacker can supply a malicious .pth file which, when processed by the torch.load function, leads to memory corruption and potential code injection.

The ability to execute arbitrary code on a server processing machine learning models presents a severe risk to organizational infrastructure. Successful exploitation could lead to full system compromise, exfiltration of sensitive model data, or the deployment of persistent threats within the development or production environment. Given the CVSS score of 8.8, this vulnerability is considered a high-priority risk requiring immediate remediation.

Immediate Action: Update the PyTorch package to version 2.10.0 or later to ensure the weights_only unpickler is properly secured.

Proactive Monitoring: Review application logs for errors related to model loading or unexpected memory usage patterns that may indicate failed or successful exploitation attempts.

Compensating Controls: Implement strict input validation or sandboxing for any untrusted model files before they are loaded into the PyTorch environment to prevent unauthorized deserialization.

Public Exploit Available: Unknown.

Organizations utilizing PyTorch for model deployment must treat this vulnerability with high urgency. Given the potential for arbitrary code execution, administrators should prioritize updating to version 2.10.0 across all affected environments immediately to eliminate the underlying deserialization risk.