CVE-2026-24747

HighCVSS 8.8/10Last modified Jul 15, 2026

Description

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-502

Affected software

VendorProductVersions
pytorchpytorch< 2.10.0
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—

References

Timeline

Published
Jan 27, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-247487.2Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authenticatCVE-2026-247495.3The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2, imCVE-2026-24754.7IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify IdentCVE-2026-247505.4Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit anCVE-2026-247518.2Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow CVE-2026-247528.2Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow CVE-2026-247536.5Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks SecCVE-2026-247545.4Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an CVE-2026-247555.4Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks SecCVE-2026-247564.3Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks SecCVE-2026-24764.3Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support pCVE-2026-247614.3Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Sec
CVE-2026-24747: High severity, CVSS 8.8 | Vulnix