Vulnerability Details CVE-2025-65213
MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and nan_inf_track_for_single_op() functions use pickle.load() on user-controlled file paths without validation, allowing arbitrary code execution. An attacker can craft a malicious pickle file that executes arbitrary Python code when loaded, enabling remote code execution with the privileges of the victim process.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 58.5%
CVSS Severity
CVSS v3 Score 9.8
Products affected by CVE-2025-65213
-
cpe:2.3:a:mthreads:torch_musa:-
-
cpe:2.3:a:mthreads:torch_musa:1.0.0
-
cpe:2.3:a:mthreads:torch_musa:1.1.0
-
cpe:2.3:a:mthreads:torch_musa:1.2.1
-
cpe:2.3:a:mthreads:torch_musa:1.3.0
-
cpe:2.3:a:mthreads:torch_musa:1.3.2
-
cpe:2.3:a:mthreads:torch_musa:2.0.0
-
cpe:2.3:a:mthreads:torch_musa:2.0.1
-
cpe:2.3:a:mthreads:torch_musa:2.1.0
-
cpe:2.3:a:mthreads:torch_musa:2.1.1
-
cpe:2.3:a:mthreads:torch_musa:2.5.0
-
cpe:2.3:a:mthreads:torch_musa:2.7.0