{"data":{"id":"0094f375-5206-4226-9066-26e543ebde09","title":"CVE-2026-24747: PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's…","summary":"CVE-2026-24747 affects PyTorch versions prior to 2.10.0. A flaw in the `weights_only` unpickler lets an attacker craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. The weakness is classified as CWE-94 and CWE-502.","solution":"Version 2.10.0 fixes the issue.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24747","publishedAt":"2026-01-28T03:15:56.470Z","cveId":"CVE-2026-24747","cweIds":["CWE-94","CWE-502"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["pytorch@< 2.10.0 (fixed: 2.10.0)"],"affectedPackageNames":["pytorch"],"affectedPackageRefs":["pypi:pytorch"],"affectedVendors":[],"affectedVendorsRaw":["PyTorch"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"PyTorch weights_only unpickler memory corruption via malicious checkpoint file","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00799,"epssCheckedAt":"2026-11-05T18:10:02.578Z","kevDateAdded":null,"advisoryAliases":["GHSA-63cw-57p8-fm3p"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:07.892Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:41:59.300Z","capecIds":["CAPEC-242","CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","safety"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"pytorch","fixedVersion":"2.10.0","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"registry","status":"version_not_found","checkedAt":"2026-10-29T21:41:59.142Z"}]}}