Tface
Monthly
Deserialization of untrusted PyTorch checkpoint files in Tencent TFace allows an attacker who convinces a user to load a malicious .ckpt/.pt weights file to execute arbitrary code, including as root, through torch.load() calls that omit weights_only=True. Tencent TFace is a research-grade face-recognition toolkit, and the vulnerable sinks span the quality evaluation and training scripts (quality/eval.py, quality/train.py), the recognition and generation/uiface training, sampling and ONNX-export code, and the attribute/M3DFEL solver. The weakness is CWE-502 and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8): exploitation is local and requires user interaction - the victim must supply or be tricked into using an attacker-controlled checkpoint as a resume, finetuning or eval-model argument - so risk is concentrated in environments that ingest third-party or untrusted model artifacts rather than against a default running service. No public exploit code was identified and the CVE is not in CISA KEV; EPSS is 0.51% (42nd percentile), consistent with a low-volume, tooling-adjacent flaw.
PyTorch checkpoint loading in Tencent TFace (restore_checkpoint and related model-loading paths) deserializes untrusted data, letting an attacker who supplies a malicious .ckpt/.pth file execute arbitrary code in the context of the user running TFace - typically root in the reference ZDI finding. The flaw is local and requires user interaction (CVSS 7.8, AV:L/AC:L/PR:N/UI:R): the victim must explicitly point the toolkit at an attacker-controlled checkpoint, for example via a --resume path or a downloaded 'pretrained' model, so realistic abuse is a supply-chain or social-engineering play against TFace operators rather than remote exploitation of a network service. The upstream project has published a fix commit that adds weights_only=True to every torch.load() call; EPSS is low (0.51%, ~42nd percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.
Deserialization of untrusted PyTorch checkpoint files in Tencent TFace allows an attacker who convinces a user to load a malicious .ckpt/.pt weights file to execute arbitrary code, including as root, through torch.load() calls that omit weights_only=True. Tencent TFace is a research-grade face-recognition toolkit, and the vulnerable sinks span the quality evaluation and training scripts (quality/eval.py, quality/train.py), the recognition and generation/uiface training, sampling and ONNX-export code, and the attribute/M3DFEL solver. The weakness is CWE-502 and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8): exploitation is local and requires user interaction - the victim must supply or be tricked into using an attacker-controlled checkpoint as a resume, finetuning or eval-model argument - so risk is concentrated in environments that ingest third-party or untrusted model artifacts rather than against a default running service. No public exploit code was identified and the CVE is not in CISA KEV; EPSS is 0.51% (42nd percentile), consistent with a low-volume, tooling-adjacent flaw.
PyTorch checkpoint loading in Tencent TFace (restore_checkpoint and related model-loading paths) deserializes untrusted data, letting an attacker who supplies a malicious .ckpt/.pth file execute arbitrary code in the context of the user running TFace - typically root in the reference ZDI finding. The flaw is local and requires user interaction (CVSS 7.8, AV:L/AC:L/PR:N/UI:R): the victim must explicitly point the toolkit at an attacker-controlled checkpoint, for example via a --resume path or a downloaded 'pretrained' model, so realistic abuse is a supply-chain or social-engineering play against TFace operators rather than remote exploitation of a network service. The upstream project has published a fix commit that adds weights_only=True to every torch.load() call; EPSS is low (0.51%, ~42nd percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.