CVE-2026-4538: linuxfoundation pytorch Improper Input Validation
Vulnerability summary
CVE-2026-4538 is a high (CVSS 7.8) Improper Input Validation vulnerability in linuxfoundation pytorch. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 22-03-2026PublishedVulnerability first disclosed.
- 23-03-2026Last modifiedVulnerability information updated.
Description
A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through a pull request but has not reacted yet.
CVSS metrics
11 scores · 5 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- CVE.orgCNA5.3MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RDiffers
- OSV · PypiEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST4.3MediumAV:L/AC:L/Au:S/C:P/I:P/A:P
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
+0.20 pp
From 0.24% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPytorch
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected systems
Debian1 product
- pytorchAll versions (No fix recorded)
Linuxfoundation1 product
- pytorch2.10.0
PyPI1 product
- torch≤ 2.10.0
Ubuntu1 product
- pytorchAll versions (No fix recorded)
4 vendors · 4 products
