docTR CVE-2026-112304

Exploitation requires that (1) the victim application calls docTR's load_pretrained_params() on a checkpoint whose path or URL is attacker-controlled or attacker-tamperable, and (2) the environment runs a PyTorch release before 2.6, since torch 2.6+ defaults torch.load to weights_only=True and blocks arbitrary pickle execution. Key limiting factors: it is not self-triggering - a user/process must actively load the malicious checkpoint (UI:P), and deployments already on torch ≥2.6 or on patched docTR (post-commit 687503d) are not exploitable even against untrusted checkpoints. No authentication bypass is involved; the attacker's leverage is supplying the poisoned model artifact.

This is a genuine but conditionally-gated code-execution flaw rather than a drop-everything emergency. The CWE-502 pickle deserialization pattern (torch.load without weights_only=True) is a well-understood, reliable RCE primitive, and the fix is confirmed by the vendor commit (687503d) adding weights_only=True. However, multiple signals temper the real-world risk: the vendor-provided CVSS 4.0 vector carries AT:P (a specific attack requirement) and UI:P (passive user interaction), meaning exploitation depends on the victim loading an attacker-controlled checkpoint AND on running torch before 2.6 - torch 2.6+ already defaults to weights_only=True, which neutralizes the bug regardless of docTR version. No KEV listing and no EPSS score are present in the input, and no public exploit or POC is referenced (only the VulnCheck advisory and the upstream issue/patch), so there is no evidence of active exploitation or weaponization. The AV:N label reflects that the malicious checkpoint can be URL-supplied, but this is not a classic unauthenticated remote-service exploit - the attacker must get a victim to point docTR at a poisoned checkpoint. Net: a legitimately high-severity, patch-now issue for anyone loading untrusted models on older torch, but not a wormable internet-facing threat.

An attacker publishes or links a malicious docTR model checkpoint (e.g. on a model hub, via a tampered download URL, or a shared file) containing a crafted pickle payload. A victim running docTR ≤1.1.0 on torch <2.6 calls load_pretrained_params() against that checkpoint, and torch.load deserializes the pickle, executing the attacker's Python code with the privileges of the loading process. No public POC is referenced, but the technique is standard and trivially reproducible.