Tencent HunyuanDiT CVE-2025-13707

Exploitation requires the victim to load or resume from an attacker-supplied model artifact via the model_resume function - i.e., the user must open a malicious file or visit a malicious page that triggers such a load (UI:R). The precondition is that HunyuanDiT performs unsafe deserialization (pickle/torch.load without weights_only) on user-supplied checkpoint data; this is the default behavior on the vulnerable PyTorch dependency (torch<2.7.1 as pinned pre-patch). LIMITING FACTORS: the attack vector is local (AV:L), so there is no direct network-service exposure; successful exploitation depends entirely on social engineering the user into loading an untrusted model, and it is mitigated by upgrading to torch>=2.7.1 (where weights_only=True is the safe default) or by refusing to load untrusted checkpoints.

This is a genuine code-execution flaw but not a drop-everything emergency for most environments. The CVSS 3.0 base score of 7.8 (High) is driven by a LOCAL attack vector (AV:L) with low complexity (AC:L) and no privileges required (PR:N), but it is gated by required user interaction (UI:R) - the victim must open or load a malicious model/file. Crucially, despite the title and ZDI advisory saying 'Remote attackers,' the CVSS vector is AV:L, so this is not a network-reachable, unauthenticated remote service exploit; it is a file/model-delivery exploit where the 'remote' aspect is social delivery of a poisoned artifact. EPSS is low at 0.51% (42nd percentile), and the vulnerability is NOT in CISA KEV, with no public exploit code identified in the provided data - so there is no evidence of active or widespread exploitation, consistent with a research-grade ML project rather than a mass-targeted enterprise service. The strongest corroborating signal is the vendor patch commit, which bumps the PyTorch dependency to torch>=2.7.1 (a version whose torch.load defaults to safe weights_only loading), strongly indicating the root cause is unsafe pickle/torch.load deserialization of an attacker-supplied checkpoint in model_resume. CONFLICT TO VERIFY: the description calls this a 'Remote Code Execution' affecting 'remote attackers,' yet CVSS is AV:L and requires UI - treat this as local/social-delivery RCE, not network RCE, when prioritizing.

An attacker crafts a malicious HunyuanDiT model checkpoint (a weaponized pickle/torch.load payload) and distributes it via a model-sharing site, link, or file, convincing a user to resume training or inference from it. When the victim loads it through the model_resume function, the untrusted data is deserialized and arbitrary code executes in the context of root. No public exploit code is identified at time of analysis, but the deserialization pattern (CWE-502) and the dependency bump to torch>=2.7.1 in the fix make exploitation straightforward to reproduce.