CVE-2026-24747 PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

What is CVE-2026-24747?

CVE-2026-24747 is a high-severity unsafe deserialization vulnerability in pytorch, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Weakness: CWE-94, CWE-502

Which versions are affected by CVE-2026-24747?

5 open source packages ship an affected version, including pytorch and torch. It affects 1 product.

Products include Linuxfoundation Pytorch.

How do I fix CVE-2026-24747?

Upgrade pytorch to 2.10.0 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-24747 being exploited?

There is no known exploitation of CVE-2026-24747 in the wild and no public exploit code.

Other vulnerabilities in pytorch

• CVE-2024-48063 Deserialization in n/a Critical 9.8
• CVE-2022-45907 PyTorch vulnerable to arbitrary code execution Critical 9.8
• CVE-2025-32434 PyTorch: `torch.load` with `weights_only=True` leads to remote code execution Critical 9.3
• CVE-2024-31583 Pytorch use-after-free vulnerability High 7.8
• CVE-2025-55551 Denial of service in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-75293, AZL-75588, BIT-pytorch-2026-24747, DEBIAN-CVE-2026-24747, ECHO-b294-6932-072f, GHSA-63cw-57p8-fm3p and 3 more.