Tencent MimicMotion CVE-2025-13716

Exploitation requires that the victim load an attacker-controlled checkpoint file (infer_config.ckpt_path) through the create_pipeline function, which pre-patch called torch.load without weights_only=True, allowing arbitrary pickle deserialization. The required precondition is therefore user interaction (UI:R): a user must be socially engineered into opening/loading a malicious model file or visiting a page that triggers that load - there is no unauthenticated network path. Limiting factors: local attack vector (AV:L), mandatory user interaction, and the need for the attacker to deliver a crafted checkpoint; the root-context impact applies only where MimicMotion is run as root. Patched versions gate loading with torch.serialization.safe_globals and weights_only=True, neutralizing arbitrary pickle execution.

This is a CWE-502 untrusted deserialization flaw in Tencent MimicMotion's create_pipeline function, which calls torch.load on an attacker-controllable checkpoint path. The provided CVSS:3.0 vector (AV:L/AC:L/PR:N/UI:R) is internally consistent and worth reconciling with the ZDI title, which labels this 'Remote Code Execution': the vector is LOCAL (AV:L) because exploitation hinges on the victim loading a malicious model/checkpoint file, not on a network-facing service - the 'remote' framing refers to attacker-supplied content delivered to the victim, not an unauthenticated network attack. PR:N means no prior privileges are needed, but UI:R (user interaction required) is the key limiting factor: a human must open the malicious file/visit a page that triggers the load. Severity is high (C:H/I:H/A:H, code execution 'in the context of root' per the description). EPSS is low at 0.51% (42nd percentile), there is NO CISA KEV listing, and no public POC is referenced - so despite the high CVSS, real-world opportunistic exploitation pressure is currently modest and depends on social-engineering a victim into loading a weaponized checkpoint. No SSVC decision data was provided in the input, so automatable/exploitation-status cannot be derived from SSVC. Net: a genuine high-impact RCE, but gated behind user interaction and a niche AI-research deployment footprint rather than a drop-everything internet-wide emergency.

An attacker publishes or shares a malicious PyTorch model checkpoint (a pickle payload) on a model hub, repo, or via a link. A MimicMotion user is tricked into loading it through create_pipeline, where torch.load deserializes the untrusted pickle and executes the embedded payload as root. No public exploit is referenced, but the technique (malicious pickle in torch.load without weights_only) is well-understood; local vector and low attack complexity make execution reliable once the file is opened.