What is the CVSS score of EUVD-2026-29096?

EUVD-2026-29096 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of CosyVoice are affected by EUVD-2026-29096?

CosyVoice (FunAudioLLM's multilingual text-to-speech toolkit) contains an arbitrary code execution vulnerability (CVSS 7.3) triggered when processing untrusted PyTorch model files through its…

How to fix or mitigate EUVD-2026-29096?

Within 24 hours, inventory all systems running FunAudioLLM and disable or restrict access to make_parquet_list.py; immediately document all .pt model files processed in the past 90 days and their sources to identify potential compromises. Within 7 days, isolate affected development systems from production networks and restrict data-preparation workflows to air-gapped systems without production credentials or access; establish policy requiring validation of .pt file provenance before processing. Within 30 days, implement containerized sandboxes for all third-party model file processing with restricted system privileges, establish file-integrity monitoring on consumed .pt files, monitor development logs for suspicious torch.load() operations, and establish an upgrade plan for FunAudioLLM to apply patches immediately upon vendor release.

CosyVoice EUVD-2026-29096

| CVE-2026-31249 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-11 mitre

GHSA-jj3w-p9wg-m6hq

RCE Python Deserialization N A

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.8 HIGH

Exploitation needs a victim to locally run the tool over an attacker-supplied file, so AV:L and UI:R; pickle deserialization yields full code execution, hence C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:02 vuln.today

CVSS changed

May 12, 2026 - 18:22 NVD

7.3 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.3

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its make_parquet_list.py data processing tool. The script loads PyTorch .pt files (utterance embeddings, speaker embeddings, speech tokens) using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing malicious .pt files within a data directory. When a victim processes this directory using the tool, arbitrary code is executed on the victim's system.

AnalysisAI

Arbitrary code execution in CosyVoice (FunAudioLLM's multilingual text-to-speech toolkit) through commit 6e01309 allows an attacker to run code on a victim's machine via a malicious PyTorch .pt file. The vulnerability lives in the make_parquet_list.py data-preparation tool, which calls torch.load() without weights_only=True, so any .pt file it ingests can carry a malicious pickle payload that executes when the victim processes an attacker-supplied data directory. Reported by MITRE with a low EPSS (0.02%, 5th percentile) and no public exploit identified at time of analysis; this is a poisoned-input/supply-chain style flaw rather than a remotely reachable network service.

Technical ContextAI

CosyVoice is a PyTorch-based speech/TTS toolkit that stores utterance embeddings, speaker embeddings, and speech tokens as serialized .pt tensor files. The root cause is CWE-502 (Deserialization of Untrusted Data): PyTorch's torch.load() defaults to the Python pickle module, which reconstructs arbitrary objects and invokes their __reduce__ methods during unpickling, enabling code execution. Passing weights_only=True restricts loading to plain tensors/primitives and is the documented mitigation; make_parquet_list.py omits it, so it will faithfully execute any pickle opcodes embedded in the .pt files it reads. The affected component is a data-processing/training-prep utility, not the inference server, meaning exposure depends on someone running the tool over untrusted data.

RemediationAI

No vendor-released patched version is identified at time of analysis (affected versions are 'n/a' in EUVD/NVD and no fix commit is cited). The direct code-level fix is to change the torch.load() calls in make_parquet_list.py to pass weights_only=True so only tensors/primitives are deserialized; teams running from source can apply this one-line change themselves after checking that all loaded .pt files are plain tensors (weights_only can break loading of legitimately pickled non-tensor objects, so validate before rolling out). As a compensating control, only process .pt datasets from trusted, integrity-verified sources - never run make_parquet_list.py over downloaded or third-party data directories, and where feasible run the tool in a sandboxed/containerized, network-isolated account with no credentials so any executed payload is contained. Track the upstream repo (https://github.com/FunAudioLLM/CosyVoice) for an official fix and monitor the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31249.