CVE-2026-24747: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-24747 is a memory corruption and arbitrary code execution vulnerability in PyTorch's weights_only unpickler, affecting all versions prior to 2.10.0. An attacker can craft a malicious checkpoint file (.pth) that, when loaded via torch.load(..., weights_only=True), bypasses the intended safety mechanism and may lead to arbitrary code execution. The vulnerability was published on January 26, 2026, and patched in PyTorch 2.10.0. It carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory, PyTorch Advisory). IBM Maximo Application Suite's Visual Inspection component is also affected as a downstream consumer of the vulnerable PyTorch package (IBM Advisory).

The root cause is improper validation of pickle opcodes and storage metadata within PyTorch's weights_only unpickler (CWE-502: Deserialization of Untrusted Data; CWE-94: Code Injection). Specifically, the unpickler failed to restrict SETITEM/SETITEMS opcodes to dictionary types only, enabling heap memory corruption when these opcodes are applied to non-dictionary objects. Additionally, a storage size mismatch between the declared element count and actual data in the archive could be exploited. The attack vector is network-based (the malicious .pth file can be distributed remotely), requires no privileges, but does require user interaction — the victim must load the crafted checkpoint file (Github Advisory, PyTorch Advisory).

Successful exploitation allows an attacker to achieve arbitrary code execution in the context of the victim's process, with full confidentiality, integrity, and availability impact. This is particularly significant in ML/AI pipelines where model checkpoints are routinely shared and loaded, as a compromised model file could silently execute attacker-controlled code on researcher or production systems. The vulnerability undermines the security guarantee of weights_only=True, which was specifically designed as a safe loading mode, making it especially dangerous for users who believed they were protected (Github Advisory, PyTorch Advisory).

A GitHub issue (pytorch/pytorch#163105) is referenced as an exploit entry point in NVD, though it primarily documents a related serialization bug rather than a weaponized PoC. No confirmed in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.065% (0.000190 per Feedly), placing it in the 20th percentile for exploitation likelihood. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures have been added by Qualys (IDs: 5007229, 916716, 916784) and Nessus (ID: 297037) (Github Advisory, Tenable).

1. Craft a malicious checkpoint file: Create a .pth file using Python's pickle module that embeds malicious pickle opcodes — specifically SETITEM/SETITEMS applied to non-dictionary objects — or introduces a storage size mismatch between declared element count and actual archive data to trigger heap corruption.
2. Distribute the malicious file: Host the crafted .pth file on a model-sharing platform (e.g., Hugging Face Hub, GitHub, or a private server), or deliver it via phishing, supply chain compromise, or a malicious model repository.
3. Social engineering: Convince the target user or automated pipeline to load the checkpoint using torch.load('malicious.pth', weights_only=True), exploiting the false sense of security provided by the weights_only=True flag.
4. Trigger code execution: When the victim's PyTorch process (version ≤ 2.9.1) deserializes the file, the malformed pickle opcodes corrupt heap memory or exploit the storage size mismatch, leading to arbitrary code execution in the context of the victim's process (Github Advisory, PyTorch Advisory).

• File System: Unexpected .pth files downloaded from untrusted or unverified sources; newly created files or scripts in directories writable by the Python/PyTorch process after loading a checkpoint.
• Process: Unusual child processes spawned by the Python interpreter after a torch.load() call (e.g., bash, sh, curl, wget, python -c); unexpected network connections initiated by the Python process.
• Logs: Python tracebacks or errors referencing pickle opcode handling or storage metadata validation during torch.load() with weights_only=True; unexpected WeightsUnpickler errors in application logs.
• Network: Outbound connections to unknown external hosts initiated shortly after loading a model checkpoint; downloads of .pth files from unrecognized or newly registered domains.

Upgrade PyTorch to version 2.10.0 or later, which includes the fix for this vulnerability (PyTorch Release). Until upgrade is possible, only load checkpoint files from fully trusted and verified sources, and avoid loading .pth files received from third parties or public repositories without validation. IBM Maximo Application Suite users should refer to the IBM security bulletin for guidance on affected Visual Inspection component versions (IBM Advisory). Organizations using automated ML pipelines should implement file integrity checks (e.g., cryptographic signatures) on model checkpoints before loading.

The vulnerability received coverage from several security news outlets and community platforms. Security Online Info published an article titled "Safety Broken: PyTorch Safe Mode Bypassed by Critical RCE Flaw," highlighting the irony of the weights_only=True bypass. CyberPress and UnderCodeNews also covered the story, emphasizing the risk to ML/AI infrastructure. The vulnerability was discussed on Reddit's r/netsec in a thread covering 22 AI/ML security advisories, and was referenced in the OWASP AISVS project pull requests, indicating growing community awareness of AI/ML supply chain security risks. The promptfoo/modelaudit project added detection for this CVE in multiple pull requests, reflecting active tooling response from the security community.