Security readout for executives and security teams
Plain-English summary
A malicious PyTorch checkpoint file can potentially take control of a system when loaded, even with the safer weights_only option. The issue affects PyTorch before 2.10.0 and is fixed in 2.10.0. Risk is highest where teams import third-party models, checkpoints, or artifacts into training, evaluation, or inference workflows.
Executive priority
Prioritize remediation for ML systems that load external model checkpoints. This is a high-severity code execution risk, but urgency depends on whether untrusted checkpoint files enter your environment.
Technical view
PyTorch before 2.10.0 has a flaw in the weights_only unpickler. A crafted .pth checkpoint loaded with torch.load(..., weights_only=True) can corrupt memory and may allow arbitrary code execution. The CVSS is 8.8 with user interaction required, mapped to CWE-502 and CWE-94.
Likely exposure
Organizations using PyTorch versions below 2.10.0 are exposed if their systems load untrusted or externally supplied checkpoint files. ML platforms, research environments, CI jobs, model registries, and inference services that ingest third-party .pth artifacts are the most relevant areas to review.
Exploitation context
The source bundle does not show known active exploitation, and KEV is false. Exploitation requires a crafted checkpoint to be loaded by a vulnerable PyTorch process. The available evidence supports potential arbitrary code execution but does not provide confirmed real-world exploitation details.
Researcher notes
Evidence identifies the vulnerable surface as the weights_only unpickler and the trigger as loading a crafted .pth checkpoint. Sources name 2.10.0 as fixed. No exploit procedure, proof of exploitation, or broader affected product list is established in the provided bundle.
Mitigation direction
- Upgrade PyTorch to version 2.10.0 or later.
- Avoid loading untrusted .pth checkpoint files.
- Restrict checkpoint ingestion to trusted sources and controlled repositories.
- Review vendor guidance for downstream packaged PyTorch versions.
- Apply Red Hat advisories where Red Hat packages are in use.
Validation and detection
- Inventory deployed PyTorch versions across hosts, containers, and notebooks.
- Flag any PyTorch version below 2.10.0.
- Review code paths using torch.load with checkpoint files.
- Identify workflows accepting external model artifacts.
- Confirm patched package versions after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-24747 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9GitHub_MCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-27T22:01:52.649Z: Reported to Red Hat.
- 2026-01-27T21:13:46.878Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3pCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/pytorch/pytorch/issues/163105CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/pytorch/pytorch/releases/tag/v2.10.0CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-24747CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2433612CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24747.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:24977CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.