---
id: CVE-2025-32434
aliases:
  - GHSA-53q9-r3pm-6pq6
  - BIT-pytorch-2025-32434
  - PYSEC-2025-41
title: 'PyTorch: `torch.load` with `weights_only=True` leads to remote code execution'
summary: 'PyTorch: `torch.load` with `weights_only=True` leads to remote code execution'
severity: critical
vendor: torch
product: torch
ecosystem: pip
affected:
  - torch < 2.6.0
patched:
  - torch 2.6.0
published: '2025-04-18'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-53q9-r3pm-6pq6'
references:
  - url: 'https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-32434'
  - url: >-
      https://github.com/pytorch/pytorch/commit/8d4b8a920a2172523deb95bf20e8e52d50649c04
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-41.yaml
  - url: 'https://github.com/pytorch/pytorch'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.02187
epssPercentile: 0.81622
ingestedAt: '2026-08-07T19:14:14.014Z'
exploits:
  github: 4
  githubRepos:
    - 'https://github.com/cyhe50/cve-2025-32434-poc'
    - 'https://github.com/B1tBit/CVE-2025-32434-exploit'
    - 'https://github.com/Soildworks/Agentic-CLIP-Benchmark'
  checkedAt: '2026-09-25T08:20:45.022Z'
exploitAvailable: true
---

## Overview

# Description
I found a Remote Command Execution (RCE) vulnerability in PyTorch. When loading model using torch.load with weights_only=True, it can still achieve RCE.  

# Background knowledge
https://github.com/pytorch/pytorch/security 
 As you can see, the PyTorch official documentation considers using `torch.load()` with `weights_only=True` to be safe.
![image](https://github.com/user-attachments/assets/fdaa8520-d66a-473a-ab1f-163d793de298)
Since everyone knows that weights_only=False is unsafe, so they will use the  weights_only=True to mitigate the seucirty issue.
But now, I just proved that even if you use weights_only=True, it can still achieve RCE.

# Credit
This vulnerability was found by Ji'an Zhou.

## Affected packages

- `torch < 2.6.0`

## Remediation

Upgrade to a patched release:

- `torch 2.6.0`