CVE-2026-73325

Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/FujitsuResearch/OneCompression/blob/main/SECURITY.md
https://pypi.org/project/onecomp/
https://pypi.org/project/onecomp/1.2.1/
https://www.vulncheck.com/advisories/fujitsu-onecompression-arbitrary-code-execution-via-torch-load-deserialization

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) La biblioteca OneCompression 1.2.0 de Fujitsu Research contiene una vulnerabilidad de deserialización insegura que permite a los atacantes ejecutar código arbitrario al proporcionar un archivo de punto de control model.pt manipulado, ya que QuantizedModelLoader.load_quantized_model_pt() llama incondicionalmente a torch.load con weights_only=False, invocyo la maquinaria pickle de Python durante la deserialización. Los atacantes pueden incrustar métodos __reduce__ maliciosos en un punto de control de modelo manipulado para ejecutar código Python arbitrario, incluyendo comyos del sistema, cuyo la biblioteca carga el archivo desde un directorio de modelo seleccionado por el llamador.

Information

Published : 2026-08-12 16:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73325

Mitre link : CVE-2026-73325

CVE.ORG link : CVE-2026-73325

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-73325", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73325", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T17:03:56.133970Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Fujitsu Research", "product": "OneCompression", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.1", "versionType": "custom"}], "defaultStatus": "affected"}]}], "published": "2026-08-12T16:17:23.000", "references": [{"url": "https://github.com/FujitsuResearch/OneCompression/blob/main/SECURITY.md", "source": "disclosure@vulncheck.com"}, {"url": "https://pypi.org/project/onecomp/", "source": "disclosure@vulncheck.com"}, {"url": "https://pypi.org/project/onecomp/1.2.1/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/fujitsu-onecompression-arbitrary-code-execution-via-torch-load-deserialization", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory."}, {"lang": "es", "value": "La biblioteca OneCompression 1.2.0 de Fujitsu Research contiene una vulnerabilidad de deserializaci\u00f3n insegura que permite a los atacantes ejecutar c\u00f3digo arbitrario al proporcionar un archivo de punto de control model.pt manipulado, ya que QuantizedModelLoader.load_quantized_model_pt() llama incondicionalmente a torch.load con weights_only=False, invocyo la maquinaria pickle de Python durante la deserializaci\u00f3n. Los atacantes pueden incrustar m\u00e9todos __reduce__ maliciosos en un punto de control de modelo manipulado para ejecutar c\u00f3digo Python arbitrario, incluyendo comyos del sistema, cuyo la biblioteca carga el archivo desde un directorio de modelo seleccionado por el llamador."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}