alexandergumeniuk/cve-2025-32434Proof-of-concept exploit for CVE-2025-32434, a critical RCE in PyTorch's torch.load() that bypasses weights_only=True via memory-mapped file writing.
CVE-2025-32434 is a critical Remote Code Execution (RCE) vulnerability in PyTorch, a widely used Python library for deep learning and neural networks.
The vulnerability exists in the torch.load() function, even when the supposedly safe weights_only=True parameter is used. The weights_only=True option was designed to prevent code execution by restricting loading to model parameters only. However, researchers found a way to bypass this protection.
| Status | Version |
|---|
| Vulnerable | PyTorch 2.5.1 and all earlier versions |
| Fixed | PyTorch 2.6.0 and later |
An unauthenticated attacker can create a malicious model file that executes arbitrary code when loaded by a victim. The attack requires no user interaction and can lead to full system compromise. The vulnerability exploits how PyTorch uses Python's pickle serialization, allowing attackers to embed malicious code in model files.
This vulnerability is particularly dangerous because many developers rely on weights_only=True as a security measure, but this vulnerability proves that even the "safe" option is not sufficient.
The provided full.py script demonstrates how to create a malicious PyTorch model that writes to a file system when loaded.
torch.from_file() to create a memory-mapped tensor pointing to the target cron file# Memory-mapped file writing
t = torch.from_file("/etc/cron.d/rev",
shared=True,
size=len(asciis),
dtype=torch.uint8)
msg = torch.tensor(asciis, dtype=torch.uint8)
t.copy_(msg) # Writes to /etc/cron.d/rev
This guide provides step-by-step instructions on how to use the CVE-2025-32434 proof of concept (PoC) script.
Before you begin, make sure you have:
# Install PyTorch (vulnerable version for testing)
pip install torch==2.5.1
pip install torch