cyhe50/cve-2025-32434-pocProof-of-concept exploit for CVE-2025-32434, a pickle deserialization vulnerability in PyTorch's weights_only mode, demonstrating malicious tar file generation and execution.
The vulnerability entry point is load() in torch/serialization.py
when protection (weights_only) is enabled: loading a tar file would call these functions in chain:
load(): torch/serialization.py:1117_load_legacy(): torch/serialization.py:1376 to torch/serialization.py:1406persistent_load(): torch/serialization.py:1474pickle_moudle.load(): torch/serialization.py:1487Unpickler.load(): torch/_weights_only_unpickler.py:214In the weights_only_unpickler mode, it's all about pickle deserialization, so searching for pickle protocol may help. reference: https://rushter.com/blog/pickle-serialization-internals/
This POC first generates a malicious tar file, note that the file name "storages" is required by the pytorch, then loads the tar file to trigger the vulnerability.
Now the tar file is executable in insecure mode. The next step is to enable the security protection and bypass the verification like this:
_pickle.UnpicklingError: Unsupported global: GLOBAL __builtin__.eval was not an allowed global by default. Please use `torch.serialization.add_safe_globals([eval])` to allowlist this global if you trust this class/function.