CVE-2025-32434

EUVD-2025-11856
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 78.72%
Affected Products (NVD)
VendorProductVersion
linuxfoundationpytorch
𝑥
< 2.6.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pytorch
bookworm
no-dsa
bullseye
vulnerable
bullseye (security)
1.7.1-7+deb11u1
fixed
forky
2.12.1+dfsg-1
fixed
sid
2.12.1+dfsg-1
fixed
trixie
2.6.0+dfsg-7
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pytorch
jammy
not-affected
oracular
not-affected
plucky
not-affected
Azure Linux logo
Azure Linux Releases
Azure Package
Release
pytorch
Azure Linux 3.0
0:2.2.2-6.azl3
fixed
CBL-Mariner 2.0
0:2.0.0-8.cm2
fixed
Common Weakness Enumeration
References
https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6
https://lists.debian.org/debian-lts-announce/2025/12/msg00000.html