PyPI/torch CVE-2026-24747: high 8.8, EPSS 0.80%
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.
Action: Upgrade torch to 2.10.0 or later.
pip install torch==2.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.10.0 | - |
Fixed versions
| 2.10.0 |
Sources
- osv: PYSEC-2026-2286
- https://access.redhat.com/security/cve/CVE-2026-24747
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24747.json
- https://access.redhat.com/errata/RHSA-2026:24977
- https://github.com/pytorch/pytorch/releases/tag/v2.10.0
- https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p
- https://bugzilla.redhat.com/show_bug.cgi?id=2433612
- https://github.com/pytorch/pytorch/issues/163105
- https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139
CVE-2026-24747 · published · modified · JSON