Bug 2360999 (CVE-2025-32434) - CVE-2025-32434 PyTorch: PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
Summary: CVE-2025-32434 PyTorch: PyTorch: `torch.load` with `weights_only=True` leads ...
Keywords:
Status: NEW
Alias: CVE-2025-32434
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2361309 2361310 2361311 2361312 2361313 2361314 2361315 2361316 2361317 2361318 2361319 2361320 2361306 2361307 2361308
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-18 16:01 UTC by OSIDB Bzimport
Modified: 2025-07-31 22:00 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-04-18 16:01:26 UTC
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.

Comment 2 Teron Seen 2025-07-31 22:00:29 UTC
During a boring lecture I noticed the guy next to me was focused on something fun on his screen. I asked him later, and he told me it was https://casinoslottica.in/ . Out of curiosity I opened it too. Turned out to be fast and easy to use. I signed up and got a few free offers to try. Later that night, I gave it a proper try and found it to be a decent way to relax when everything else feels repetitive.


Note You need to log in before you can comment on or make changes to this bug.