CVE-2026-4538: 
Homebrew vulnerability analysis and mitigation

CVE-2026-4538 is a deserialization vulnerability in PyTorch 2.10.0 affecting the pt2 Loading Handler component (torch.export.load). The flaw allows a local, low-privileged attacker to trigger arbitrary code execution by loading a maliciously crafted .pt2 file. It was disclosed on March 22, 2026, with a fix pull request submitted to the PyTorch project on March 7, 2026, which was subsequently closed unmerged. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Bugzilla, Feedly).

The root cause is improper input validation (CWE-20) leading to deserialization of untrusted data (CWE-502) within torch.export.load. Specifically, torch.export.load lacks a mechanism to enforce secure deserialization: if a loaded .pt2 archive contains use_pickle: True in its model_weights_config.json, or if an exception occurs during deserialization, the code silently falls back to pickle.load with weights_only=False. An attacker can craft a malicious .pt2 ZIP archive by injecting a pickle payload into the weights directory and modifying the config JSON to reference it with use_pickle: True, causing arbitrary Python code execution when the file is loaded. A public proof-of-concept demonstrating this technique (including spawning calc.exe) was included in the fix pull request (PyTorch PR #176791).

Successful exploitation grants an attacker full control over the host process running PyTorch, with high impact to confidentiality, integrity, and availability. Because the attack executes arbitrary code in the context of the loading application, an attacker could exfiltrate model weights, training data, or credentials accessible to the process, modify model behavior, or disrupt service availability. The attack is local and requires low privileges, limiting its scope to systems where an attacker can supply or influence .pt2 files loaded by a PyTorch application (PyTorch PR #176791, Red Hat Bugzilla).

A public proof-of-concept exploit script was included in the disclosure pull request and is publicly available (PyTorch PR #176791). The EPSS score is approximately 0.016% (0.000160), indicating low current probability of widespread exploitation. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog. The CVSS v4.0 exploit maturity is rated as Proof-of-Concept (Feedly).

1. Prepare a benign .pt2 file: Export and save a legitimate PyTorch model using torch.export.export() and torch.export.save() to produce a baseline benign.pt2 archive.
2. Craft a malicious pickle payload: Create a Python class with a __reduce__ method that executes an arbitrary OS command (e.g., os.system('calc.exe')) and serialize it with pickle.dumps().
3. Modify the archive: Open benign.pt2 as a ZIP file, locate model_weights_config.json, and inject a new entry into the config referencing a malicious payload path with "use_pickle": true.
4. Inject the payload: Write the serialized pickle payload as a new file inside the ZIP archive at the path referenced in the config (e.g., <root>/data/weights/malicious_payload).
5. Deliver the file: Place the crafted malicious.pt2 in a location where the target application will load it (e.g., a shared model repository, a writable directory, or via social engineering).
6. Trigger execution: When the victim application calls torch.export.load('malicious.pt2'), the _load_state_dict or _load_constants function reads the config, detects use_pickle: True, and calls pickle.load() on the payload, executing the attacker's code (PyTorch PR #176791).

• File System: Unexpected .pt2 files in model directories with anomalous ZIP contents (extra files under data/weights/ not matching expected tensor names); model_weights_config.json entries containing "use_pickle": true for non-standard weight keys.
• Process: Unusual child processes spawned by a Python/PyTorch process (e.g., calc.exe, cmd.exe, /bin/bash, curl, wget) immediately following a model load operation.
• Logs: Python tracebacks or exception logs from deserialize_torch_artifact or _load_state_dict followed by unexpected process activity; application logs showing torch.export.load called on externally-supplied files.
• Network: Unexpected outbound connections from the PyTorch application process to external IPs shortly after model loading, potentially indicating a reverse shell or data exfiltration payload (PyTorch PR #176791).

PyTorch has not released an official patched version; the fix pull request (#176791) was closed unmerged as of March 15, 2026, and PyTorch has not acknowledged the report (PyTorch PR #176791). IBM has issued advisories for affected products including watsonx Code Assistant On Prem and IBM Observability with Instana (IBM Advisory). Recommended mitigations include: (1) only load .pt2 files from trusted, verified sources; (2) restrict local system access to trusted users on systems running PyTorch; (3) apply the patch from PR #176791 manually by adding weights_only=True support to torch.export.load if operationally feasible; (4) isolate PyTorch model-loading workloads in sandboxed environments with minimal privileges; (5) monitor for the IOCs described above.

The vulnerability was reported by a security researcher from China via a GitHub pull request to the PyTorch project on March 7, 2026, but the PR was closed without being merged and PyTorch maintainers have not publicly acknowledged the issue (PyTorch PR #176791). Red Hat tracked the issue in Bugzilla (Bug 2450062) with medium severity, and IBM issued security bulletins for affected downstream products (Red Hat Bugzilla, IBM Advisory). A downstream project (McKinsey agents-at-scale-ark) publicly documented the unresolved status and chose to whitelist the CVE as unresolvable given the lack of an upstream fix, noting the vulnerability only applies when loading user-supplied .pt2 files (PyTorch PR #176791).