Tencent MedicalNet CVE-2025-13714

Exploitation requires the victim to load an attacker-supplied pretrained model file: the generate_model function must be invoked with opt.pretrain_path pointing to a malicious PyTorch checkpoint (.pth), which torch.load deserializes via unsafe pickle. The limiting factor is mandatory user interaction (UI:R) - a human must choose to open or load the malicious file - and the LOCAL attack vector (AV:L) means there is no network-exposed service; the attacker cannot reach the code without the victim's file-loading action. This is not reachable against a default/idle installation; it triggers only along the pretrained-model loading code path. Vulnerable builds are those before commit 1679f7c that call torch.load without weights_only=True.

This is a classic Python/PyTorch pickle deserialization flaw (CWE-502): the generate_model function in model.py calls torch.load(opt.pretrain_path) without weights_only, so loading an attacker-controlled pretrained model file executes arbitrary pickle reduce payloads. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: it is LOCAL vector plus REQUIRED user interaction, NOT a remotely-reachable network service - ZDI's 'remote attacker' phrasing refers to social-engineering delivery of a malicious .pth file, not an unauthenticated network RCE, which is an important distinction defenders should not misread. Exploitation signals are modest: EPSS is 0.51% (42nd percentile), there is NO CISA KEV listing and no public exploit was identified in the provided data, so this is no public exploit identified at time of analysis. The high CVSS is driven by the root-level code execution impact (C:H/I:H/A:H), not by ease or likelihood of real-world attack. Net: a genuinely high-impact bug but a low-urgency one in practice - it requires a victim to be tricked into loading a malicious model file into a niche research codebase, which is targeted/opportunistic rather than mass-exploitable. The torch.load source evidence corroborates the deserialization root cause and the fix (weights_only=True plus a safe_globals allowlist).

An attacker publishes or sends a malicious 'pretrained' PyTorch model (.pth) file - e.g. on a model hub, in a repo, or by email - and persuades a researcher to use it as opt.pretrain_path. When generate_model calls torch.load on the file, the embedded pickle payload executes and runs arbitrary code in the context of root. No public exploit code was identified in the provided data, but the technique (malicious pickle in a torch checkpoint) is well understood and trivially weaponizable.