EUVD-2026-63459
GHSA-5whh-98v9-qrw2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L because exploitation requires opening a local file; PR:N as attacker needs no system privileges; UI:R confirmed by description; full C/I/A impact from arbitrary code execution.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27987.
AnalysisAI
Remote code execution in Hugging Face PyTorch Image Models (timm) version 1.0.24 is triggered when a user loads a crafted model checkpoint file, exploiting unsafe deserialization of untrusted data. The vulnerability, discovered by ZDI (ZDI-CAN-27987) and tracked as ZDI-26-523, allows an attacker who can deliver a malicious checkpoint to achieve full code execution in the context of the victim's process with no special system privileges required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to explicitly load a checkpoint file controlled by the attacker using the timm library's checkpoint parsing functionality - for example, via model loading APIs that internally call torch.load() on a .pt or .pth file path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the threat model: high impact but constrained by a local attack vector and mandatory user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-523/ for vendor patch details and any updated fixed release; no exact patched version has been independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct inventory of all timm 1.0.24 deployments and immediately notify ML engineering teams of the vulnerability risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today