Critical severity9.8NVD Advisory· Published Apr 18, 2025· Updated Jun 17, 2026
CVE-2025-32434
CVE-2025-32434
Description
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
torchPyPI | < 2.6.0 | 2.6.0 |
Affected products
8- osv-coords6 versionspkg:apk/chainguard/py3.11-pytorch-cuda-12.3pkg:apk/chainguard/py3.11-torchvision-cuda-12.3pkg:apk/chainguard/py3.11-wheels-torch-cuda-12.3pkg:apk/chainguard/py3.11-wheels-torchvision-cuda-12.3pkg:bitnami/pytorchpkg:pypi/torch
< 0+ 5 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 2.6.0
- (no CPE)range: < 2.6.0
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-53q9-r3pm-6pq6ghsaADVISORY
- github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-32434ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-41.yamlghsaWEB
- github.com/pytorch/pytorch/commit/8d4b8a920a2172523deb95bf20e8e52d50649c04ghsaWEB
- lists.debian.org/debian-lts-announce/2025/12/msg00000.htmlnvd
News mentions
0No linked articles in our index yet.