Tencent TFace CVE-2025-13709

Exploitation requires the victim to load an attacker-controlled model checkpoint through the vulnerable restore_checkpoint path, where torch.load() is invoked without weights_only=True (confirmed by the fix diff across solver.py, main.py, vqgan.py, sample.py, eval.py and related training/eval scripts). The concrete prerequisite is that the user opens or resumes from a malicious .ckpt/.pth file (e.g. an untrusted 'pretrained' model or one passed via a --resume/checkpoint path). This works against default configurations because historic torch.load defaulted to weights_only=False. Limiting factors: it is NOT remotely exploitable over a network service - it needs local delivery of a file plus explicit user interaction (UI:R) to load it, which constrains realistic exploitation to supply-chain / social-engineering scenarios against TFace operators.

This is a classic PyTorch pickle-deserialization (CWE-502) remote code execution flaw: the fix diff confirms the root cause is torch.load(...) called without weights_only=True, meaning a malicious checkpoint file executes embedded pickle payloads during load. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent with the description: the attack vector is LOCAL (AV:L) and requires user interaction (UI:R), because the victim must be induced to load an attacker-supplied model file - this is NOT a remotely-triggerable network service flaw despite the 'Remote Code Execution' label in the title. The signals are mostly aligned and point to MODERATE real-world priority: EPSS is low (0.51%, 42nd percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or imminent mass exploitation. The main aggravating factor is that code runs in the context of root per the description, so successful exploitation yields full host compromise. Note a wording tension to verify: the description calls this 'Remote' RCE, but the CVSS vector is AV:L with UI:R, indicating the realistic path is social-engineering a user into loading a malicious checkpoint rather than network exploitation - treat it as a supply-chain / untrusted-model-file risk, not an internet-facing exposure.

An attacker publishes or sends a weaponized model checkpoint (e.g. a .ckpt/.pth file) and convinces a TFace user - a researcher or ML engineer - to load it, for example via a training/eval/resume workflow or by downloading a 'pretrained' model from an untrusted repository. When restore_checkpoint calls torch.load() without weights_only=True, the embedded pickle payload executes and runs arbitrary code as root. No public exploit is identified at time of analysis, but the technique (malicious PyTorch pickle) is well-known and trivially reproducible.