EUVD-2026-29097
GHSA-jf74-gj4g-6qpg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attacker supplies a malicious file processed locally (AV:L) that the victim must run the tool on (UI:R); pickle deserialization yields full code execution, so C/I/A:H, unlike the published Low impacts.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its average_model.py model averaging tool. The script loads PyTorch checkpoint files (epoch_*.pt) for model averaging using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing malicious checkpoint files within a directory. When a victim uses the tool to average models from this directory, arbitrary code is executed on the victim's system.
AnalysisAI
Arbitrary code execution in CosyVoice (FunAudioLLM's open-source multilingual text-to-speech toolkit) arises because its average_model.py utility calls PyTorch's torch.load() on epoch_*.pt checkpoint files without weights_only=True, allowing pickle-based deserialization of attacker-controlled objects. Any user who runs the model-averaging tool against a directory containing a malicious checkpoint executes attacker code on their machine. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), but the CWE-502 pattern is trivially weaponizable and SSVC marks it automatable.
Technical ContextAI
The affected component is the model-averaging helper in CosyVoice, a neural TTS/voice-cloning framework built on PyTorch. PyTorch checkpoints are Python pickle streams; torch.load() by default reconstructs arbitrary objects and will invoke __reduce__ handlers embedded in a crafted pickle, which is the classic CWE-502 (Deserialization of Untrusted Data) root cause. The introduction of the weights_only=True flag in modern PyTorch restricts loading to tensor data and known safe globals; because average_model.py omits this flag, a malicious epoch_*.pt file can carry an executable payload that runs during load. CPE data is unhelpful here (listed as cpe:2.3:a:n/a:n/a:*), so affected identification rests on the source repository (github.com/FunAudioLLM/CosyVoice) and the commit boundary named in the description.
RemediationAI
No vendor-released patch version has been identified at time of analysis; the corrective code change is to modify average_model.py to call torch.load(..., weights_only=True) (and more broadly to load checkpoints in a restricted-unpickling mode), so track the upstream repository at https://github.com/FunAudioLLM/CosyVoice for a fixed commit or release. Until a fixed build is confirmed, only run the model-averaging tool on checkpoint directories you produced or fully trust, and never on epoch_*.pt files downloaded from third parties, shared model hubs, or untrusted collaborators; treating downloaded model weights as untrusted code is the key compensating control. Optionally run the averaging step inside a sandboxed, network-isolated container or unprivileged user account so that a malicious pickle payload cannot reach sensitive credentials or persist - the trade-off is added pipeline friction and setup overhead. Verify checkpoint provenance with hashes/signatures where possible; the side effect is operational overhead maintaining a trusted-artifact inventory.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today