PyTorch torch.load weights_only Bypass RCE
- Product
- PyTorch PyTorch
- CVE
- CVE-2025-32434
- Disclosed
- 2025-04-18
- CVSS
- 9.8
- Auth
- requires auth / interaction
- CISA KEV
- no
- Affected
- PyTorch <= 2.5.1
- Fixed
- 2.6.0
Summary
torch.load(weights_only=True) was the officially recommended safe way to load untrusted model files. Researcher Ji'an Zhou showed it could still be made to execute code, so loading a malicious checkpoint compromised the machine.
Root cause
weights_only=True is meant to restrict unpickling to an allowlist of tensor-related types. Researcher Ji'an Zhou found a loading path where attacker-controlled data in a crafted model file escaped those restrictions, so torch.load still executed arbitrary code. Code that relied on weights_only=True as a security boundary was therefore unsafe.
Impact
Code execution on any system that loads an attacker-supplied model file, including model hubs, training pipelines and inference services.
Detection
Inventory torch versions < 2.6.0 in environments that load third-party checkpoints; scan models with tools such as picklescan/ModelScan.
Mitigation
Upgrade to PyTorch 2.6.0+, prefer safetensors, and only load models from trusted sources.