CVE-2026-73325: RCE via malicious .pt checkpoint load

CISO Take

Fujitsu Research's OneCompression library (onecomp on PyPI) loads quantized model checkpoints by calling torch.load() with weights_only=False, which means any .pt file placed in a model directory the application reads from can smuggle a pickle payload that executes arbitrary Python and system commands the moment it's deserialized. This isn't a network-exploitable bug — it requires local access and a user or automated pipeline to trigger the load — but the barrier to weaponize it is low (CVSS 7.8, AC:L, PR:N) and pickle-based RCE in ML checkpoint loaders is a well-understood attack class with public tooling. There's no evidence of active exploitation (not in CISA KEV, CISA SSVC rates it TRACK, no public exploit or Nuclei template), and EPSS puts real-world exploitation probability at just 0.26% despite ranking in the 82nd percentile among all scored CVEs, so this is a hygiene issue rather than a fire drill. Upgrade to onecomp 1.2.1 or later, and in the meantime treat any model directory your pipeline points OneCompression at as untrusted input — validate provenance, scan checkpoints with a tool like picklescan or fickling before load, and never let it read from user-writable or shared paths.

Sources:NVDEPSSCISA KEVATLAS

What is the risk?

Moderate-to-high technical severity (CVSS 7.8, full C/I/A impact) offset by local attack vector and required user interaction, which caps real-world exploitation likelihood. EPSS (0.26%) and the absence of KEV listing, public exploit code, or scanner coverage indicate this is not being actively targeted. The realistic risk driver is insider/supply-chain exposure: any workflow that lets an untrusted party influence which model directory OneCompression loads from (shared model repos, CI artifact stores, multi-tenant ML platforms) converts this into a practical code-execution path.

How does the attack unfold?

Stage malicious checkpoint

Attacker crafts a model.pt file with a pickle __reduce__ payload and places it where OneCompression's model directory will read it (public hub, shared registry, or CI artifact store).

AML.T0018.002

Victim triggers load

A user or automated pipeline calls QuantizedModelLoader.load_quantized_model_pt() pointing at the attacker-controlled directory.

AML.T0011.000

Deserialization exploitation

torch.load() with weights_only=False invokes Python's pickle machinery, which executes the embedded __reduce__ payload.

AML.T0050

Code execution impact

Attacker gains arbitrary code execution in the context of the ML pipeline process, enabling credential theft, lateral movement, or pipeline tampering.

Stage malicious checkpoint

Attacker crafts a model.pt file with a pickle __reduce__ payload and places it where OneCompression's model directory will read it (public hub, shared registry, or CI artifact store).

AML.T0018.002

Victim triggers load

A user or automated pipeline calls QuantizedModelLoader.load_quantized_model_pt() pointing at the attacker-controlled directory.

AML.T0011.000

Deserialization exploitation

torch.load() with weights_only=False invokes Python's pickle machinery, which executes the embedded __reduce__ payload.

AML.T0050

Code execution impact

Attacker gains arbitrary code execution in the context of the ML pipeline process, enabling credential theft, lateral movement, or pipeline tampering.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade to onecomp 1.2.1+, which should address the weights_only=False default (verify in release notes/changelog). 2) Until patched, do not point QuantizedModelLoader at directories writable by untrusted users, external contributors, or third-party model sources. 3) Scan any third-party or externally-sourced .pt checkpoints with picklescan or fickling before they reach the loader. 4) Where feasible, wrap model-loading steps in a sandboxed/least-privilege process so a pickle RCE can't reach broader credentials or infrastructure. 5) Detection: monitor for unexpected subprocess spawns or outbound connections originating from ML pipeline/model-loading processes, which is the tell for a pickle __reduce__ payload firing.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainModelFrameworkAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0018.002- Embed Malware AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10-Third-party and customer relationships

NIST AI RMF

MAP-4.1-Third-party AI resources are identified, assessed, and monitored

OWASP LLM Top 10

LLM03-Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-73325?

Fujitsu Research's OneCompression library (onecomp on PyPI) loads quantized model checkpoints by calling torch.load() with weights_only=False, which means any .pt file placed in a model directory the application reads from can smuggle a pickle payload that executes arbitrary Python and system commands the moment it's deserialized. This isn't a network-exploitable bug — it requires local access and a user or automated pipeline to trigger the load — but the barrier to weaponize it is low (CVSS 7.8, AC:L, PR:N) and pickle-based RCE in ML checkpoint loaders is a well-understood attack class with public tooling. There's no evidence of active exploitation (not in CISA KEV, CISA SSVC rates it TRACK, no public exploit or Nuclei template), and EPSS puts real-world exploitation probability at just 0.26% despite ranking in the 82nd percentile among all scored CVEs, so this is a hygiene issue rather than a fire drill. Upgrade to onecomp 1.2.1 or later, and in the meantime treat any model directory your pipeline points OneCompression at as untrusted input — validate provenance, scan checkpoints with a tool like picklescan or fickling before load, and never let it read from user-writable or shared paths.

Is CVE-2026-73325 actively exploited?

No confirmed active exploitation of CVE-2026-73325 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-73325?

1) Upgrade to onecomp 1.2.1+, which should address the weights_only=False default (verify in release notes/changelog). 2) Until patched, do not point QuantizedModelLoader at directories writable by untrusted users, external contributors, or third-party model sources. 3) Scan any third-party or externally-sourced .pt checkpoints with picklescan or fickling before they reach the loader. 4) Where feasible, wrap model-loading steps in a sandboxed/least-privilege process so a pickle RCE can't reach broader credentials or infrastructure. 5) Detection: monitor for unexpected subprocess spawns or outbound connections originating from ML pipeline/model-loading processes, which is the tell for a pickle __reduce__ payload firing.

What systems are affected by CVE-2026-73325?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, model registries / artifact stores, CI/CD for ML pipelines.

What is the CVSS score for CVE-2026-73325?

CVE-2026-73325 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesmodel registries / artifact storesCI/CD for ML pipelines

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0018.002Embed Malware

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: A.10

NIST AI RMF: MAP-4.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.

Exploitation Scenario

An attacker contributes a poisoned quantized checkpoint to a public model hub, internal shared model store, or a CI artifact cache that a victim's ML pipeline treats as trusted. The checkpoint's pickle stream embeds a __reduce__ method wired to a system command. When the victim's pipeline calls QuantizedModelLoader.load_quantized_model_pt() against that directory — as part of routine model deployment, benchmarking, or a CI job — torch.load() deserializes the file, pickle invokes the __reduce__ payload, and the attacker gains code execution on the host running the pipeline, with the ability to exfiltrate credentials, pivot to other systems, or tamper with the broader ML environment.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.