CVE-2025-32434

PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security-advisories@github.com

Published

2025-04-18

Last modified

2025-12-01

Weaknesses

CWE-502

Affected products

• Pytorch (Linuxfoundation)
• Pytorch (Pytorch)

References

• https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6
• https://lists.debian.org/debian-lts-announce/2025/12/msg00000.html