PyTorch vulnerabilities
We track 10 vulnerabilities in PyTorch products across 4 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.
Latest PyTorch vulnerabilities
- 7.8 High severity
TorchServe: Creation of Temporary File in Directory with Insecure Permissions
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
- 7.1 High severity
vision: Out-of-bounds Read
PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause
- 7.8 High severity
A vulnerability was identified in PyTorch 2.10.0.
A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly av
- 8.8 High severity
pytorch: Improper Control of Generation of Code
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=T
- 9.8 Critical severity
pytorch: Deserialization of Untrusted Data
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading
- 7.5 High severity
PyTorch: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to
- 9.8 Critical severity
pytorch: Deserialization of Untrusted Data
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
- 8.2 High severity
serve: Exposure of Resource to Wrong Sphere
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two int
- 9.8 Critical severity
serve: Use of Incorrectly-Resolved Name or Reference
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being down
- 9.8 Critical severity
serve: Server-Side Request Forgery
TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken adv