CVE-2026-73325 - Fujitsu OneCompression 1.2.0 Arbitrary Code Execution via torch.load Deserialization
Brief
CVE ID : CVE-2026-73325
Published : Aug. 12, 2026, 4:17 p. m.
- 47 minutes ago
Description : Fujitsu Research's OneCompression library 1.
- 0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model. pt checkpoint file, as QuantizedModelLoader. load_quantized_model_pt() unconditionally calls torch. load with weights_only=False, invoking Python's pickle machinery during deserialization.
Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.
Severity: 8.4
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...