Community Notice: :pytorch: Critical CVE

Discussion News
1

CVE-2025-32434 in PyTorch

A critical vulnerability (CVSS 9.3) :skull: has been identified in PyTorch versions < 2.6.0. Exploiting this issue via torch.load with weights_only=True could allow remote code execution (RCE) due to deserialization of untrusted data.

Affected Versions: PyTorch < 2.6.0

Fix: Upgrade to PyTorch 2.6.0 or later.

Reference: PyTorch GitHub Advisory

Recommended Actions:

  • Update to the most recent version of PyTorch compatible with your system if possible.
  • If you’re unable to update, you should evaluate the risk for your situation.
  • Always ensure that you’re downloading and loading weights from an official and trusted source.