PyTorch Image Models EUVD-2026-63459

Exploitation requires the victim to explicitly load a checkpoint file controlled by the attacker using the timm library's checkpoint parsing functionality - for example, via model loading APIs that internally call torch.load() on a .pt or .pth file path. The CVSS vector UI:R confirms user interaction is mandatory; the attacker cannot remotely trigger deserialization without the victim taking an action to open or process the malicious file. The CVSS PR:N indicates the attacker requires no privileges on the victim's system - delivery is the only prerequisite. No non-default configuration or specific deployment mode is required; any invocation of timm's checkpoint loading with an attacker-supplied file path is sufficient. Exploitation is limited by the need to deliver the malicious file to the target, which typically requires social engineering, a compromised dependency source, or a poisoned model repository. The AV:L designation means the malicious file must reach the local filesystem or be directly opened, ruling out purely network-based exploitation without a delivery step.

The CVSS 3.0 base score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the threat model: high impact but constrained by a local attack vector and mandatory user interaction. The attacker cannot trigger exploitation remotely without first delivering the malicious file and having the victim explicitly load it - typically via social engineering, a compromised model repository, or a malicious public upload. No EPSS score was provided in the available data, which limits probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog and no public POC has been identified at time of analysis, suggesting exploitation has not yet been observed at scale. Despite the AV:L designation, real-world risk is elevated for data science and ML engineering teams who routinely download and load third-party pretrained weights without verification - the trust boundary for checkpoint files in this ecosystem is weak. The CVSS AC:L rating reflects that no special configuration or environmental condition beyond file loading is required once the malicious file is in the victim's environment.

An attacker crafts a malicious timm-compatible checkpoint file embedding a pickle payload that executes a reverse shell or data exfiltration command, then uploads it to a public model hub or sends it to a targeted ML engineer under the guise of a pretrained model. When the victim runs code such as timm.create_model() referencing the local checkpoint path, the deserialization step fires the embedded payload and arbitrary code executes as the victim's user account. No public POC has been identified at time of analysis, but the attack technique is well-documented for PyTorch pickle deserialization and requires no specialized tooling beyond crafting a malicious pickle object.