Tencent FaceDetection-DSFD CVE-2025-13715

Exploitation requires the victim to load an attacker-controlled model file through the resnet code path, where torch.load() (self.model_path) deserializes a Python pickle without validation (CWE-502). The concrete prerequisite is that the application loads a PyTorch .pth/weights file whose origin the attacker controls. Limiting factors that reduce real-world risk: user interaction is mandatory (UI:R - the target must actively open the malicious file or visit the delivering page), the vector is local rather than network (AV:L), and the affected product is a niche open-source research project, so there is no default network-exposed service to attack. There is no authentication barrier for the attacker (PR:N), but the social-engineering/interaction gate is the practical constraint.

Signals point to a serious-but-constrained issue rather than a widespread emergency. The CVSS 3.0 base score of 7.8 (HIGH) is driven by total impact (C:H/I:H/A:H) and code execution as root, but the vector is LOCAL (AV:L) and requires user interaction (UI:R) - the victim must open or load an attacker-supplied PyTorch model file. This is the classic CWE-502 pickle-deserialization flaw in torch.load(), confirmed by the source diff touching model/resnet.py. EPSS is low at 0.43% (36th percentile), there is no CISA KEV listing, and no public exploit was identified, so automated mass-exploitation is unlikely; SSVC-style reading is exploitation=none, automatable=no (interaction-gated), technical impact=total. CONFLICT TO VERIFY: the description calls these 'remote attackers' who 'visit a malicious page or open a malicious file', yet the CVSS vector is AV:L (local) - this is ZDI's standard framing for file/model-delivered RCE and should be read as local-with-user-interaction, not network-remote. Additional caveat: the linked 'fix' commit only adds map_location to torch.load() and does NOT actually remediate the pickle deserialization, so the referenced patch may be incomplete - verify with the vendor before treating it as fixed. Net: real and high-impact for anyone running this research code, but low urgency given the niche footprint and interaction requirement.

An attacker crafts a malicious PyTorch model (.pth) file containing a pickle payload and tricks a user into loading it through the resnet model path (e.g., hosting it on a page or sending it as a 'pretrained weights' file). When the victim runs the DSFD resnet code, torch.load() deserializes the untrusted data and executes the attacker's code as root. No public exploit was identified at time of analysis, though the technique (pickle RCE via torch.load) is well understood.