CosyVoice CVE-2026-31250

Exploitation requires that a victim actually run the average_model.py model-averaging tool and point it at a directory containing an attacker-supplied malicious epoch_*.pt PyTorch checkpoint; the vulnerable code path is the torch.load() call made without weights_only=True. Limiting factors: the attacker cannot trigger this remotely on their own - it depends on victim user interaction (running the tool) and on the attacker first getting a crafted checkpoint into a directory the victim processes (via a shared/downloaded model, compromised repo, or social engineering). It is therefore constrained to environments that perform model averaging on externally sourced checkpoints; installations that only average locally produced, trusted checkpoints are not realistically exposed. Despite the published CVSS marking UI:N/AV:N, the description's 'when a victim uses the tool' wording confirms required user interaction and file/local delivery - verify against the vendor writeup.

Signals conflict and should be weighed carefully. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:L/I:L/A:L = 7.3) both understates and overstates the flaw: it understates impact because successful pickle deserialization yields full arbitrary code execution (should be C:H/I:H/A:H, not Low), yet it overstates reachability by marking UI:N and AV:N when the description clearly requires a victim to run the averaging tool against attacker-supplied files - that is user interaction and a local/file-delivery vector, not unauthenticated remote exploitation. EPSS is negligible (0.02%, 5th percentile), SSVC exploitation status is 'none' (not in CISA KEV, no known active exploitation), and no POC is referenced, so this is not an at-scale internet-facing threat. However SSVC flags it automatable with partial technical impact, and the exploit primitive itself is reliable once a victim is induced to process a poisoned checkpoint. Net: a genuine RCE worth patching for anyone running CosyVoice training/averaging pipelines, but low urgency relative to a network-exploitable KEV entry - it is a supply-chain/untrusted-model-file risk, not a mass-exploitation one.

An attacker publishes a poisoned model checkpoint (e.g., a 'pretrained' or community-shared epoch_10.pt) on a model hub or sends it as a collaboration artifact. A CosyVoice user drops it into a directory and runs average_model.py to blend it with other epochs; torch.load() unpickles the file and the embedded payload executes with the victim's privileges, giving the attacker code execution and access to that user's data and credentials. No public POC is referenced, but the technique is well-known and reliable given AC:L.