CVE-2025-32434Critical▾ AbyssalPoC availablePyTorch: `torch.load` with `weights_only=True` leads to remote code execution
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
Depth score65/ 100 · Elevated
impact 52.3 · likelihood 0.4 · exploitation 12
Proof of concept
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Published
Apr 18, 2025
Updated
Aug 7, 2026
CVSS
—
Vendor
torch
Product
torch
CWE
—
Depth score
65 · Elevated
EPSS
2.1% · p80
Platforms
—
Source
OSV
Vector
—
Exploit availability
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
- GitHub PoCs
- 4 public repositories
EPSS history
Exploit-prediction probability, daily snapshots since Aug 7.
Timeline
Disclosure to exploitation, from the record and what we observed since indexing it.
- Published
Disclosed via OSV
- Record revised
Last analysed / modified upstream
- EPSS first tracked
1.9%
- Public exploit observed
4 GitHub repos
- EPSS peak
1.9% → 2.1%
Affected
- torch < 2.6.0
Patched in
- torch 2.6.0
Full technical detail▾
Overview
Description
I found a Remote Command Execution (RCE) vulnerability in PyTorch. When loading model using torch.load with weights_only=True, it can still achieve RCE.
Background knowledge
https://github.com/pytorch/pytorch/security
As you can see, the PyTorch official documentation considers using torch.load() with weights_only=True to be safe.
Since everyone knows that weights_only=False is unsafe, so they will use the weights_only=True to mitigate the seucirty issue.
But now, I just proved that even if you use weights_only=True, it can still achieve RCE.
Credit
This vulnerability was found by Ji'an Zhou.
Affected packages
torch < 2.6.0
Remediation
Upgrade to a patched release:
torch 2.6.0
References
- https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6
- https://nvd.nist.gov/vuln/detail/CVE-2025-32434
- https://github.com/pytorch/pytorch/commit/8d4b8a920a2172523deb95bf20e8e52d50649c04
- https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-41.yaml
- https://github.com/pytorch/pytorch
Change history
Field changes observed since this record was first indexed.
- Sep 8, 2026Public exploit / PoC published
- Sep 8, 2026Public exploit flag cleared
- Sep 8, 2026Public exploit / PoC published
- Sep 8, 2026Public exploit flag cleared
- Sep 8, 2026Public exploit / PoC published
Related vulnerabilities
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-2953Low· 3.3PyTorch susceptible to local Denial of Service
same productshared advisory#osvCVE-2024-31580High· 7.5PyTorch heap buffer overflow vulnerability
same productshared advisory#osvCVE-2025-3000Medium· 5.3PyTorch is vulnerable to memory corruption through its torch.jit.script function
same productshared advisory#osvCVE-2025-3730Low· 3.3PyTorch Improper Resource Shutdown or Release vulnerability
same productshared advisory#osvCVE-2025-3001NoneA vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulat…
same product#osvCVE-2025-2999NoneA vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpa…
same product#osv
#osv#pip#exploit-available