{"affected":[{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json"},"package":{"ecosystem":"PyPI","name":"torch","purl":"pkg:pypi/torch"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.10.0"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","1.0.1","1.1.0","1.10.0","1.10.1","1.10.2","1.11.0","1.12.0","1.12.1","1.13.0","1.13.1","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.4.0","2.4.1","2.5.0","2.5.1","2.6.0","2.7.0","2.7.1","2.8.0","2.9.0","2.9.1"]}],"aliases":["BIT-pytorch-2026-24747","CVE-2026-24747","PYSEC-2026-1856","PYSEC-2026-2286"],"database_specific":{"cwe_ids":["CWE-502","CWE-94"],"github_reviewed":true,"github_reviewed_at":"2026-01-27T20:10:54Z","nvd_published_at":"2026-01-27T22:15:56Z","severity":"HIGH"},"details":"### Summary\n\nA vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution.\n\n### Vulnerability Details\n\nThe `weights_only=True` unpickler failed to properly validate pickle opcodes and storage metadata, allowing:\n\n1. **Heap memory corruption** via `SETITEM`/`SETITEMS` opcodes applied to non-dictionary types\n2. **Storage size mismatch** between declared element count and actual data in the archive\n\n### Impact\n\nAn attacker who can convince a user to load a malicious checkpoint file may achieve arbitrary code execution in the context of the victim's process.\n\n\n# Credit\nJi'an Zhou","id":"GHSA-63cw-57p8-fm3p","modified":"2026-11-04T03:15:10.870748916Z","published":"2026-01-27T20:10:54Z","references":[{"type":"WEB","url":"https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24747"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/163105"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-24747"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433612"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-63cw-57p8-fm3p"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pytorch/PYSEC-2026-1856.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2026-2286.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/releases/tag/v2.10.0"},{"type":"WEB","url":"https://pypi.org/project/pytorch"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24747.json"}],"schema_version":"1.9.2","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"}],"summary":"PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files"}