CVE-2026-112304: docTR: unsafe torch.load deserialization enables RCE

HIGH

Published October 19, 2026

CISO Take

docTR through 1.1.0 loads model checkpoints with torch.load without weights_only=True, so a malicious pickle embedded in a checkpoint file or URL-supplied weights executes arbitrary Python code in the loading process (CWE-502). The CVSS is 7.5 (high) and requires user interaction and high attack complexity, because the attacker must get a victim to load a tampered checkpoint. Exploitation likelihood is low-to-moderate: EPSS is 0.0029 (top 80th percentile), the CVE is not in CISA KEV, and no public exploit or Nuclei template exists. Dependent counts are unknown, but docTR is a widely used OCR library often embedded in document-processing pipelines that run with access to sensitive data. Upgrade to a docTR release that includes the fix commit 687503d, upgrade torch to 2.6 or later (where weights_only defaults to True), and only load checkpoints from trusted, integrity-verified sources.

Sources:NVDEPSSATLASVulnCheckGitHub

What is the risk?

Moderate overall risk. Impact is full code execution (C:H/I:H/A:H) with the privileges of the loading process, but exploitation needs a victim to load an attacker-controlled checkpoint (UI:R, AC:H). Exposure is greatest where checkpoint paths or URLs are configurable by users or pulled from untrusted hubs. Environments on torch 2.6 or later are largely protected because weights_only defaults to True. No known active exploitation, no KEV listing, and a low EPSS of 0.0029 lower near-term urgency, but the pickle attack class is trivial once a malicious file is delivered.

How does the attack unfold?

Artifact Preparation

Attacker crafts a docTR checkpoint with a malicious pickle payload and publishes it to a model hub, URL or shared storage.

AML.T0058

Delivery

A victim or automated pipeline is induced to load the tampered checkpoint through a local path or URL.

AML.T0010.003

Exploitation

load_pretrained_params() calls torch.load without weights_only=True, deserializing the pickle and executing attacker code.

AML.T0011.000

Impact

Attacker gains code execution on the host and can steal credentials and document data or move laterally.

Artifact Preparation

Attacker crafts a docTR checkpoint with a malicious pickle payload and publishes it to a model hub, URL or shared storage.

AML.T0058

Delivery

A victim or automated pipeline is induced to load the tampered checkpoint through a local path or URL.

AML.T0010.003

Exploitation

load_pretrained_params() calls torch.load without weights_only=True, deserializing the pickle and executing attacker code.

AML.T0011.000

Impact

Attacker gains code execution on the host and can steal credentials and document data or move laterally.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
docTR	—	—	No patch

Do you use docTR? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade docTR to a version containing the fix (commit 687503dd) once released, or apply the patch manually. 2) Upgrade torch to 2.6 or later so torch.load defaults to weights_only=True. 3) Only load checkpoints from trusted sources, verify hashes or signatures, and prefer safetensors formats. 4) Do not allow end users to supply checkpoint paths or URLs. 5) Run model loading in sandboxed, least-privilege containers with restricted egress. 6) Scan checkpoint files with picklescan or fickling before use. 7) Detect by inventorying docTR versions via SBOM and monitoring for unexpected child processes or outbound connections from OCR workers.

How is it classified?

Code ExecutionSupply ChainFrameworkModelAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0018.002- Embed Malware AML.T0058- Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MAP 4.1-Risks of third-party software and data are mapped

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-112304?

Is CVE-2026-112304 actively exploited?

No confirmed active exploitation of CVE-2026-112304 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-112304?

1) Upgrade docTR to a version containing the fix (commit 687503dd) once released, or apply the patch manually. 2) Upgrade torch to 2.6 or later so torch.load defaults to weights_only=True. 3) Only load checkpoints from trusted sources, verify hashes or signatures, and prefer safetensors formats. 4) Do not allow end users to supply checkpoint paths or URLs. 5) Run model loading in sandboxed, least-privilege containers with restricted egress. 6) Scan checkpoint files with picklescan or fickling before use. 7) Detect by inventorying docTR versions via SBOM and monitoring for unexpected child processes or outbound connections from OCR workers.

What systems are affected by CVE-2026-112304?

This vulnerability affects the following AI/ML architecture patterns: Document OCR pipelines, Model serving, Training and fine-tuning pipelines, Model loading from external registries.

What is the CVSS score for CVE-2026-112304?

CVE-2026-112304 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

Document OCR pipelinesModel servingTraining and fine-tuning pipelinesModel loading from external registries

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0018.002Embed Malware

AML.T0058Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MAP 4.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.

Exploitation Scenario

An attacker publishes a fine-tuned docTR text-recognition checkpoint on a public model hub or file share, advertising improved accuracy on a specific document type. A data scientist or an automated pipeline downloads it and calls load_pretrained_params(), which runs torch.load without weights_only=True. The embedded pickle payload executes on load, giving the attacker a reverse shell on the GPU or inference host, where they harvest cloud credentials and access document data processed by the OCR service.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.