CVE-2026-4538

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-4538
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4538.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-4538
Aliases
Downstream
Published
2026-03-22T04:20:28.356Z
Modified
2026-07-15T01:49:08.526492197Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
PyTorch pt2 Loading deserialization
Details

A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through a pull request but has not reacted yet.

Database specific 
{
    "cwe_ids": [
        "CWE-20",
        "CWE-502"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4538.json"
}
References

Affected packages

Git / github.com/pytorch/pytorch

Affected ranges

Type
GIT
Repo
https://github.com/pytorch/pytorch
Events
Introduced
449b1768410104d3ed79d3bcfe4ba1d65c7f22c0
Last affected
449b1768410104d3ed79d3bcfe4ba1d65c7f22c0
Database specific 
{
    "cpe": "cpe:2.3:a:linuxfoundation:pytorch:2.10.0:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "2.10.0"
        },
        {
            "last_affected": "2.10.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

2.*
2.10.0
v2.*
v2.10.0
v2.10.0-rc7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4538.json"