Back to Database
Status published
Critical
CVE-2025-32434
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
Vulnerability Description
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32434
Credits & Attribution
No credits recorded in the NVD database.
More from pytorch
View All →CVE-2024-6577
Unclaimed S3 Bucket Usage in pytorch/serve
Medium
6.3
CVE-2024-35199
TorchServe gRPC Port Exposure
High
8.2
CVE-2024-35198
TorchServe bypass allowed_urls configuration
Critical
9.8
CVE-2023-48299
TorchServe ZipSlip
Medium
5.3
CVE-2023-43654
TorchServe Server-Side Request Forgery
Critical
10
Affected Vendor
pytorch
View all reports →Affected Software
pytorch
Vulnerable Versions:
< 2.6.0
Timeline
Official Publish:
April 18th, 2025
Last Modified:
December 1st, 2025
Added to House:
July 22nd, 2026