PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139 | Broken Link |
| https://github.com/pytorch/pytorch/issues/163105 | Exploit Issue Tracking |
| https://github.com/pytorch/pytorch/releases/tag/v2.10.0 | Product Release Notes |
| https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p | Vendor Advisory |
Configurations
History
30 Jan 2026, 21:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139 - Broken Link | |
| References | () https://github.com/pytorch/pytorch/issues/163105 - Exploit, Issue Tracking | |
| References | () https://github.com/pytorch/pytorch/releases/tag/v2.10.0 - Product, Release Notes | |
| References | () https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p - Vendor Advisory | |
| CPE | cpe:2.3:a:linuxfoundation:pytorch:*:*:*:*:*:python:*:* | |
| First Time |
Linuxfoundation
Linuxfoundation pytorch |
27 Jan 2026, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-27 22:15
Updated : 2026-01-30 21:51
NVD link : CVE-2026-24747
Mitre link : CVE-2026-24747
CVE.ORG link : CVE-2026-24747
JSON object : View
Products Affected
linuxfoundation
- pytorch