8.8
High
CVE-2026-24747 PyTorch is a Python package that provides tensor computation
Description
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| pytorch 2.10 | earliest → < 2.10.0 | 2.10.0 |
| Red Hat OpenShift AI 2.25 1780069069 | earliest → < 1780069069 | 1780069069 |
| Red Hat OpenShift AI (RHOAI) | Versions not published |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of pytorch
The 4 CVEs of pytorch →
CVE-2025-32434
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built…
9.3
Critical
CVE-2024-48063
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE
Not rated
CVE-2024-31580
PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component…
4.0
Medium