Tencent TFace CVE-2025-13711

Exploitation requires the victim to load an attacker-controlled model checkpoint through a TFace workflow that calls torch.load() without weights_only=True - the fixed code paths include quality/eval.py, quality/train.py, recognition and generation/uiface training and sample scripts, and the ONNX export converter. The concrete prerequisite is that the user supplies or is tricked into using a malicious .ckpt/.pt weights file as a checkpoint/resume/finetuning/eval-model argument. Limiting factors: this is LOCAL exploitation (AV:L) requiring user interaction (UI:R) to open/load the malicious file; there is no network-exposed 'eval' service in the patched code, so exploitation does not occur against a default running service but only when untrusted model files are processed. Risk is therefore confined to environments that ingest third-party or untrusted model artifacts.

This is a PyTorch pickle-style deserialization RCE (CWE-502) in Tencent TFace, a research-grade face-recognition toolkit. The signals are consistent but point to moderate real-world urgency rather than an emergency. The provided CVSS:3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High): exploitation is LOCAL and requires user interaction (the victim must load an attacker-supplied file), not a remote network-reachable endpoint - note the NVD/ZDI title says 'Remote Code Execution' and 'remote attackers,' which conflicts with the AV:L (local) metric; the realistic interpretation from the source evidence is that a user is tricked into loading a malicious model checkpoint, so treat 'remote' as supply/delivery of a file, not direct network access. EPSS is low (0.51%, 42nd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. The technical impact is severe (code execution as root per the description, full C/I/A loss), but the LOCAL + UI:R prerequisites and the niche, research-oriented deployment footprint meaningfully cap practical risk. Net: a genuine high-severity code-execution bug worth patching, but NOT a drop-everything priority absent exposure of the affected workflows to untrusted model files.

An attacker publishes or sends a maliciously crafted PyTorch model checkpoint (e.g., a .ckpt/.pt weights file) and convinces a TFace user to load it through one of the training/eval/sample workflows. When the victim's process calls torch.load() on the untrusted file, the embedded pickle payload executes arbitrary code in the context of the running process - described as root. No public exploit code is identified at time of analysis, but the technique (pickle deserialization via torch.load without weights_only) is well understood and trivial to weaponize.