Vulnerability Details CVE-2026-24747
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 3.1%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2026-24747
-
cpe:2.3:a:linuxfoundation:pytorch:-
-
cpe:2.3:a:linuxfoundation:pytorch:2.2.0
-
cpe:2.3:a:linuxfoundation:pytorch:2.2.1
-
cpe:2.3:a:linuxfoundation:pytorch:2.2.2
-
cpe:2.3:a:linuxfoundation:pytorch:2.3.0
-
cpe:2.3:a:linuxfoundation:pytorch:2.3.1
-
cpe:2.3:a:linuxfoundation:pytorch:2.4.0
-
cpe:2.3:a:linuxfoundation:pytorch:2.4.1
-
cpe:2.3:a:linuxfoundation:pytorch:2.5.0
-
cpe:2.3:a:linuxfoundation:pytorch:2.5.1
-
cpe:2.3:a:linuxfoundation:pytorch:2.6.0
-
cpe:2.3:a:linuxfoundation:pytorch:2.7.0
-
cpe:2.3:a:linuxfoundation:pytorch:2.7.1