CVE-2026-4538CWE-20CWE-502

PyTorch pt2 Loading deserialization

Medium · published March 22, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through a pull request but has not reacted yet.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00441 · 37.3th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2026-03-22T04:20Z
EPSS history
Timeline
  • 22 MAR 04:20Z
    PyTorch pt2 Loading deserialization
    cvelistv5