CVE-2026-24747: Verified Repro With Script Download

Q: How does the CVE-2026-24747 attack work?

An attacker distributes a malicious `.pth` checkpoint whose pickle stream drives `SETITEM`/`SETITEMS` against a `Tensor` object instead of a dict/list; because the unpickler never verifies the target's type, the call reaches `Tensor.__setitem__()` and writes controlled floats into tensor storage, corrupting heap memory in the process that loaded the checkpoint - even though `weights_only=True` was meant to prevent pickle-based exploitation.

Pruva

CVE-2026-24747: Verified Repro With Script Download

CVE-2026-24747: PyTorch: weights only Unpickler RCE via SETITEM Type Confusion

Download script Open in Codespaces

CVE-2026-24747 is verified against torch · pip. Affected versions: <=2.9.1. Fixed in 2.10.0. Vulnerability class: RCE. This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00119.

REPRO-2026-00119 torch · pip RCE Mar 2, 2026 CVE entry ↗ .txt

Severity

HIGH

CVSS

8.8

Reproduced in

48m 8s

Tool calls

178

01 · Overview

What Is CVE-2026-24747?

CVE-2026-24747 (GHSA-63cw-57p8-fm3p) is a high-severity memory-corruption vulnerability in PyTorch's weights_only unpickler, where a malicious checkpoint (.pth) file loaded with torch.load(..., weights_only=True) can corrupt heap memory. Pruva reproduced it (reproduction REPRO-2026-00119).

02 · Severity & CVSS

CVE-2026-24747 Severity & CVSS Score

CVE-2026-24747 is rated high severity, with a CVSS base score of 8.8 out of 10.

HIGH threat level

8.8 / 10 CVSS base

Weakness CWE-94 — Improper Control of Generation of Code ('Code Injection')

High — serious impact or readily exploitable. Prioritize remediation.

03 · Affected Versions

Affected torch Versions

torch · pip versions <=2.9.1 are affected.

05 · How to Reproduce

Download script Open in Codespaces →

$ pruva-verify REPRO-2026-00119

or

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00119/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh

Run in a VM or disposable container. This exploits a real vulnerability.

06 · Proof of Reproduction

Proof of Reproduction for CVE-2026-24747

Reproduced by Pruva's autonomous agents — 178 tool calls over 48 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 184 events · 178 tool calls · 48 min

48 minDuration

178Tool calls

0Reasoning steps

184Events

1Dead-ends

Agent activity over 48 min

Support

11

Repro

44

Variant

80

Coding

44

0:0048:08

Root Cause and Exploit Chain for CVE-2026-24747

Summary

CVE-2026-24747 is a high-severity vulnerability (CVSS 8.8) in PyTorch's weights_only unpickler that allows an attacker to craft a malicious checkpoint file (.pth) which, when loaded with torch.load(..., weights_only=True), corrupts heap memory and can potentially lead to arbitrary code execution. The vulnerability exists because the SETITEM and SETITEMS pickle opcodes in torch/_weights_only_unpickler.py perform no type check on the target object before calling __setitem__. This allows an attacker to invoke Tensor.__setitem__() through the pickle stream, writing arbitrary float values directly into tensor storage memory on the heap.

Impact

Package/component affected: PyTorch (torch), specifically torch/_weights_only_unpickler.py
Affected versions: All PyTorch versions prior to 2.10.0 (confirmed on 2.9.1)
Patched version: PyTorch 2.10.0
Risk level: HIGH (CVSS 8.8 — Network/Low complexity/No privileges/User interaction required)
Consequences:
- Heap memory corruption via controlled writes to tensor storage
- The weights_only=True safety feature, designed to prevent pickle-based code execution, is bypassed
- An attacker who distributes a malicious .pth model file can corrupt arbitrary heap memory in the victim's process
- This memory corruption primitive can potentially be chained with heap layout techniques to achieve arbitrary code execution
- Particularly dangerous in ML pipelines where model checkpoints are routinely downloaded from public repositories (Hugging Face, GitHub, model zoos)

Root Cause

The root cause is the absence of type checking in the SETITEM and SETITEMS opcode handlers within the Unpickler class in torch/_weights_only_unpickler.py.

Vulnerable Code (PyTorch 2.9.1)

In the Unpickler.load() method:

# SETITEM handler (line ~440)
elif key[0] == SETITEM[0]:
    (v, k) = (self.stack.pop(), self.stack.pop())
    self.stack[-1][k] = v        # <-- NO TYPE CHECK!

# SETITEMS handler (line ~443)
elif key[0] == SETITEMS[0]:
    items = self.pop_mark()
    for i in range(0, len(items), 2):
        self.stack[-1][items[i]] = items[i + 1]  # <-- NO TYPE CHECK!

The code performs self.stack[-1][k] = v without verifying that self.stack[-1] is a dictionary type. In normal pickle usage, SETITEM/SETITEMS are used to populate dictionaries. However, the restricted unpickler allows construction of Tensor objects via _rebuild_tensor_v2, and if a Tensor ends up as the top-of-stack when SETITEM executes, it invokes Tensor.__setitem__(key, value).

Tensor.__setitem__ writes float values directly to the tensor's underlying storage buffer, which is heap-allocated. This gives the attacker a controlled heap write primitive: they can write arbitrary float values at specific indices within the tensor's storage region.

Attack Flow

Attacker crafts a .pth (zip) file containing a pickle payload
The pickle uses GLOBAL + REDUCE to construct a Tensor via _rebuild_tensor_v2 (this is allowed)
Before the Tensor is consumed by a dict SETITEM, the pickle inserts additional SETITEMS opcodes that target the Tensor on the stack
Each SETITEMS pair (index, value) calls tensor[index] = value, writing to heap memory
The victim loads this file with torch.load("file.pth", weights_only=True) — the weights_only=True flag is supposed to prevent code execution, but this bypass circumvents the protection

Fix

The fix in PyTorch 2.10.0 adds type checking to SETITEM/SETITEMS, ensuring they can only operate on dictionary types (dict, OrderedDict), not on Tensor or other arbitrary objects.

CVE: CVE-2026-24747
Advisory: GHSA-63cw-57p8-fm3p
Fix release: PyTorch v2.10.0

Reproduction Steps

Run repro/reproduction_steps.sh which:
- Installs PyTorch 2.9.1 (CPU, vulnerable version)
- Verifies the vulnerable SETITEM handler has no type check
- Crafts a malicious .pth checkpoint file with pickle bytecode that:
  - Constructs a Tensor via the allowed _rebuild_tensor_v2 path
  - Uses SETITEMS opcode to write 10 attacker-controlled float values to the Tensor
- Loads the malicious checkpoint with torch.load(..., weights_only=True)
- Verifies that all 10 controlled values were written successfully
Expected output: VULNERABILITY_CONFIRMED — all 10 magic values match (1337.0, 31337.0, 42.0, 0xDEAD, 0xBEEF, 0xCAFE, 0xBABE, 0xFACE, 9999.99, 12345.0)

Evidence

Vulnerable Code Path

The SETITEM/SETITEMS handlers in the weights_only unpickler at torch/_weights_only_unpickler.py perform self.stack[-1][k] = v without any type check. This allows calling Tensor.__setitem__() through the pickle stream.

Exploit Output

[+] torch.load succeeded!
[+] Result type: <class 'dict'>
[+] Keys: ['malicious_weights']
[+] Tensor shape: torch.Size([10]), dtype: torch.float32
[+] Tensor values: tensor([1.3370e+03, 3.1337e+04, 4.2000e+01, 5.7005e+04, 4.8879e+04, ...])

[*] Verifying attacker-controlled memory writes:
    tensor[0] =       1337.0  (expected       1337.0) [MATCH]
    tensor[1] =      31337.0  (expected      31337.0) [MATCH]
    tensor[2] =         42.0  (expected         42.0) [MATCH]
    ...all 10 values MATCH...

[+] VULNERABILITY CONFIRMED: CVE-2026-24747
[+] SETITEMS opcode called __setitem__ on a Tensor object
[+] without any type check in the weights_only unpickler.
[+] Attacker wrote 10 controlled values to tensor memory.

Environment

PyTorch 2.9.1+cpu
Python 3.12
CPU-only (no CUDA required)
Linux x86_64

Recommendations / Next Steps

Immediate fix: Upgrade PyTorch to version 2.10.0 or later

Fix approach: Add type checking to SETITEM/SETITEMS handlers:

elif key[0] == SETITEM[0]:
    (v, k) = (self.stack.pop(), self.stack.pop())
    if type(self.stack[-1]) not in (dict, OrderedDict):
        raise UnpicklingError(
            f"Can only SETITEM on dict/OrderedDict, but got {type(self.stack[-1])}"
        )
    self.stack[-1][k] = v

Defense in depth: Organizations should validate the integrity (hash verification) of all .pth checkpoint files before loading
Consider migration: Use safetensors format for model distribution instead of pickle-based .pth files
Variant analysis: The BUILD opcode handler also has potential issues — while OrderedDict.__dict__.update(state) can't override __setitem__ (a C-slot method), other BUILD targets or new allowlisted types could introduce similar bypass opportunities

Additional Notes

Idempotency: The reproduction script runs consistently on repeated executions. Confirmed with two consecutive successful runs.
Limitations:
- The exploit demonstrates the memory corruption primitive (controlled writes to tensor storage). Converting this to direct arbitrary code execution would require heap spraying techniques that are environment-dependent and non-deterministic.
- The CVE itself classifies this as "can corrupt memory and potentially lead to arbitrary code execution" — the memory corruption primitive is the core vulnerability.
- The weights_only=True parameter was specifically designed as a safety measure against pickle-based attacks, making this bypass particularly impactful from a trust boundary perspective.
Storage size mismatch: The CVE also mentions "storage size mismatch between declared element count and actual data." This is validated at the storage loading level by PyTorch's zip reader, but the SETITEM bypass is independently exploitable.

CVE-2026-24747 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40

0:00

support

repro

7:44