CRITICAL 9.8 Microsoft PoC

CVE-2025-32434

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

Microsoft Security Update 2025-Apr: PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

Affected Products

cbl2 pytorch 2.0.0-9 on CBL Mariner 2.0
cbl2 pytorch 2.0.0-9 on CBL-Mariner 2.0
cbl2 pytorch 2.0.0-8 on CBL Mariner 2.0
azl3 pytorch 2.2.2-6 on Azure Linux 3.0
azl3 pytorch 2.2.2-7 on Azure Linux 3.0

References

Published: 2025-04-08 · Source: Microsoft · Feed updated: 2026-10-12

This critical severity vulnerability with a CVSS score of 9.8 was published on 2025-04-08 via Microsoft. 🚨 A public proof-of-concept exploit is available on GitHub. Affected: cbl2 pytorch 2.0.0-9 on CBL Mariner 2.0, cbl2 pytorch 2.0.0-9 on CBL-Mariner 2.0, cbl2 pytorch 2.0.0-8 on CBL Mariner 2.0 and 2 more.

Risk Timeline

CVE Disclosed2025-04-08 · 552 days ago

Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible

Remediation Resources

Official Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32434

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2025-32434

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2017-20230	Storable versions before 3.05 for Perl has a stack overflow	CRITICAL	10.0
CVE-2025-62878	Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern	CRITICAL	9.9
CVE-2025-71074	functionfs: fix the open/removal races	CRITICAL	9.8
CVE-2025-29087	In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can	CRITICAL	9.8
CVE-2025-3277	An integer overflow can be triggered in SQLite’s `concat_ws()` function. The res	CRITICAL	9.8
CVE-2026-27143	Missing bound checks can lead to memory corruption in safe Go in cmd/compile	CRITICAL	9.8

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.