Hunyuan3D-1 CVE-2025-13713

Exploitation requires the victim to invoke the load_pretrained function on an attacker-supplied model file/checkpoint, i.e., loading untrusted serialized (pickle/torch.load) data - the inbound data is not validated before deserialization. This is NOT remote-unauthenticated: the CVSS vector is AV:L/UI:R, so the attack is local in execution and gated on user interaction (the target must open a malicious file or visit a malicious page). Limiting factors: no network-exposed service is required to be vulnerable, the attacker needs the victim to load the malicious artifact, and vulnerable deployments are those running the affected code against pre-2.6 PyTorch (where torch.load defaults to unsafe weights_only=False). The severity multiplier is that the process runs as root, so successful deserialization yields full host compromise.

This is a genuine but not emergency-grade priority. The CVSS 3.0 base score of 7.8 is driven by a LOCAL attack vector (AV:L) with required user interaction (UI:R), not network-reachable exploitation - the victim must actively load an attacker-supplied model/file. CWE-502 (deserialization of untrusted data) in load_pretrained yields full code execution as root (C:H/I:H/A:H), which is severe once triggered. Countervailing signals keep real-world risk moderate: EPSS is only 0.52% (43rd percentile), indicating low predicted exploitation probability; there is no CISA KEV listing and no public exploit identified; and the vector requires local access plus user interaction, limiting mass exploitation. Note an apparent tension worth flagging: the description repeatedly says 'remote attackers' while the CVSS vector is AV:L (local) with UI:R - this is consistent with the ZDI 'open a malicious file / visit a malicious page' model (the payload is delivered remotely but execution is local on victim action), so the 'root' impact and local vector should be read together rather than as network RCE. The patch (torch upgrade to 2.6.0) corroborates a PyTorch pickle/torch.load deserialization root cause.

An attacker publishes or shares a malicious pretrained model file (e.g., a trojanized checkpoint) and lures a victim into loading it with Hunyuan3D-1's load_pretrained function, or into visiting a page that triggers that load. When the untrusted data is deserialized, embedded objects execute attacker-controlled code in the context of root. No public proof-of-concept is identified at time of analysis, though the flaw was discovered and detailed by Trend Micro's Zero Day Initiative (ZDI-25-1027 / ZDI-CAN-27191).