Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through a pull request but has not reacted yet.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-22 | 5 | Disclosure2General3 |
| 2026-03-25 | 1 | Disclosure1 |
CVE-2026-4538 Local Deserialization Vulnerability in PyTorch 2.10.0 pt2 Loading Handler https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4538
Post summary
The entry identifies a local deserialization flaw in PyTorch 2.10.0 but provides no proof‑of‑concept, exploit, or patch information.
CVE-2026-4538: PyTorch 2.10.0—load .pt2 model, get RCE. Researcher submitted fix, PyTorch ignored it. PoC public, unpatched. PickleScan doesn't cover pt2. Data scientists download from HuggingFace like Napster. Your AI pipeline is a malware registry. Unsigned.
Post summary
A critical RCE vulnerability in PyTorch 2.10.0 allows arbitrary code execution via .pt2 models; a public PoC exists but the submitted patch was ignored, leaving the issue unpatched.
⚡ New CVE Alert: CVE-2026-4538 📊 Severity: 5.3 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4538 #CVE-2026-4538 #CVE #Medium #CyberSecurity #InfoSec https://t.co/z5KWF2917n
Post summary
The tweet announces a new CVE with basic severity info, but offers no detailed technical data, exploits, or patch information.
CVE-2026-4538 A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserializ… https://www.cve.org/CVERecord?id=CVE-2026-4538
Post summary
A new vulnerability (CVE-2026-4538) in PyTorch 2.10.0 has been disclosed; details are limited to an unknown function that can manipulate deserialization.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-4538 - PyTorch pt2 Loading deserialization Intel Report: https://ift.tt/dzuGhtP
Post summary
An alert is issued for CVE-2026-4538, a PyTorch deserialization vulnerability, with a linked Intel report, but no evidence of exploitation, PoC, or mitigation details.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-4538 - PyTorch pt2 Loading deserialization Intel Report: https://ift.tt/CUlHdAm
Post summary
An alert cites CVE-2026-4538 impacting PyTorch deserialization, but no PoC, exploit, active exploitation, patch, or false‑positive claim is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | linuxfoundation | pytorch | 2.10.0 | python | - |