CVE-2025-32434
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.
Reserved 2025-04-08 | Published 2025-04-18 | Updated 2025-04-18 | Assigner GitHub_MCWE-502: Deserialization of Untrusted Data
github.com/...ytorch/security/advisories/GHSA-53q9-r3pm-6pq6
Support options
