torchdistill EUVD-2026-98206

Exploitation requires that the load_ckpt function in torchdistill/common/main_util.py be invoked with an attacker-influenced src_ckpt argument pointing to a malicious (pickle-serialized) checkpoint, and requires LOCAL access with low privileges (PR:L, AV:L) - not remote exploitation. The core limiting factor is that an attacker must already be able to run code or place/supply a checkpoint file on the system, and the victim application must load that untrusted checkpoint; default usage with trusted, self-generated checkpoints is not exploitable. There is no remote/network vector and no unauthenticated path. Because the maintainer treats checkpoint loading as trusted-input behavior, deployments that only ever load first-party checkpoints are effectively not at risk.

This is a low-to-moderate priority issue despite the deserialization (CWE-502) class typically being severe. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 4.8 (Medium) and explicitly requires LOCAL access with LOW privileges, which sharply limits real-world risk compared to a network-exploitable deserialization flaw. The 'E:P' in the vector and the reference set confirm a public proof-of-concept exists, so publicly available exploit code exists - but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The most important signal is the maintainer's own response in the referenced GitHub issue (#550): they closed it as a duplicate and consider the behavior 'tolerable for this project,' meaning no fix is planned and the project treats loading checkpoints as inherently trusted input. In practice this flaw primarily matters to anyone who loads untrusted PyTorch checkpoint files via load_ckpt; it is not a mass-exploitation candidate. Note a tension worth verifying: the input impact metrics are rated LOW (VC:L/VI:L/VA:L), yet Python pickle-based deserialization normally yields arbitrary code execution (full impact) - the low ratings likely reflect the reporter's view that only a local, already-authorized actor supplying their own file is affected. Treat impact as potentially higher than the Medium score suggests if untrusted checkpoints can reach load_ckpt.

A local, low-privileged user (or any workflow that ingests an externally sourced model checkpoint) supplies a crafted malicious checkpoint path as the src_ckpt argument to torchdistill's load_ckpt function. When the checkpoint is deserialized, attacker-controlled pickle data executes, compromising the process. A public proof-of-concept is referenced in GitHub issue #550.