CVE-2025-32434: PYSEC-2025-41 - PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based aut

CVE-2025-32434 · Severity: medium · CVSS 4 · Published 2025-04-18

Technologies: torch (PyPI). Vendors: PyPI.

Executive brief

PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.

Affected products

PyPI torch

Related threats

PYSEC-2026-1970 - PyTorch Improper Resource Shutdown or Release vulnerability
PYSEC-2026-139 - A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The mani
PyTorch arbitrary code execution in weights_only unpickler
PyTorch denial of service in torch.profiler.profile
PYSEC-2025-209 - An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.