flash-attention CVE-2026-31253

Exploitation requires the victim to load an attacker-controlled checkpoint file through the framework's own code paths - specifically load_checkpoint() in checkpoint.py during model warmstarting, or the checkpoint loader in eval.py during evaluation. The concrete prerequisite is that torch.load() is invoked without weights_only=True (the vulnerable default in this code) on a file the attacker can supply, e.g. a poisoned checkpoint obtained from a public model hub, a shared drive, or a compromised mirror. The key limiting factor is that this is NOT truly zero-interaction despite the published UI:N: a human/pipeline must actively choose to load the malicious artifact, so social engineering or trust in the artifact's provenance is the real gate. Exploitation does not require authentication to the victim system and needs no special privileges once the file is loaded, but it is bounded to environments that actually run flash-attention's training/eval scripts against third-party checkpoints.

The signals conflict and should be read carefully. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 7.3) implies remote, unauthenticated, zero-interaction exploitation, but the description makes clear the victim must actively load an attacker-supplied checkpoint - that is effectively user interaction (UI:R) and a local/file-delivery step, so the published UI:N appears too generous. Conversely the impact metrics (C:L/I:L/A:L) look too low for what is described as arbitrary code execution, which normally warrants High confidentiality/integrity/availability. Corroborating the low practical urgency: EPSS is 0.02% (5th percentile), there is no KEV listing, no POC is referenced, and CISA's SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial. Net assessment: a genuine RCE-class weakness but one gated by social-engineering/trust in the artifact source, so it is a real-but-not-urgent priority - patch on a normal cycle and prioritize higher for teams that ingest third-party checkpoints. Note the discrepancy: CVSS marks UI:N and only partial impact, whereas the described behavior is full code execution requiring a victim action - verify scoring against the vendor.

An attacker publishes a fine-tuned model checkpoint on a public model hub or shares it with a research team, embedding a malicious pickle payload via a crafted __reduce__ method. A victim runs the framework's warmstart or evaluation flow and calls load_checkpoint() on the file; torch.load() unpickles it and the attacker's code runs with the victim's privileges, enabling credential theft or lateral movement. No public POC is referenced, but exploitation is technically trivial once the file is loaded (AC:L).