CVE-2026-24747

Katalog CVE

CVSS 8.8 · High EPSS 0,81%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada linuxfoundation pytorch. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Rincian

Terbit di NVD

27 Januari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p advisory vendor
• https://github.com/pytorch/pytorch/issues/163105 exploit · issue tracking
• https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139 broken link
• https://github.com/pytorch/pytorch/releases/tag/v2.10.0 product · release notes
• https://access.redhat.com/errata/RHSA-2026:24977
• https://access.redhat.com/security/cve/CVE-2026-24747
• https://bugzilla.redhat.com/show_bug.cgi?id=2433612
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24747.json