{"data":{"id":"ec9bd69e-2209-4956-800a-fdbaf5506646","title":"CVE-2025-32434: PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks…","summary":"CVE-2025-32434 affects PyTorch version 2.5.1 and prior. Loading a model with torch.load using weights_only=True allows Remote Command Execution (RCE), classified as CWE-502 (Deserialization of Untrusted Data). GitHub, Inc. scored it CVSS 4.0 9.3 CRITICAL, with no NVD assessment yet.","solution":"This issue has been patched in version 2.6.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-32434","publishedAt":"2025-04-18T20:15:23.183Z","cveId":"CVE-2025-32434","cweIds":["CWE-502"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["torch@< 2.6.0 (fixed: 2.6.0)"],"affectedPackageNames":["torch"],"affectedPackageRefs":["pypi:torch"],"affectedVendors":[],"affectedVendorsRaw":["PyTorch"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"PyTorch remote command execution when loading models with torch.load","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.02369,"epssCheckedAt":"2026-11-04T00:12:27.047Z","kevDateAdded":null,"advisoryAliases":["GHSA-53q9-r3pm-6pq6"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:55.527Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-01-29T16:17:26.260Z","daysToFix":-79,"fixCheckedAt":"2026-10-29T21:44:38.645Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"torch","fixedVersion":"2.6.0","matchedVersion":"2.6.0","fixReleasedAt":"2025-01-29T16:17:26.260Z","daysToFix":-79,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:38.494Z"}]}}