CVE-2026-73325

Unsafe deserialization in OneCompression allows RCE via a crafted model file.

• CVSS 8.4
• 502
• Input Validation and Sanitization
• Local

Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.

CVE

CVE-2026-73325

CWE

502

CVSS base score

8.4

Published

2026-08-12

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Serialization Issues

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

OneCompressi

Fixed by upgrading

Yes

Solution

Upgrade the OneCompression library to version 1.2.1 or later.

import os
import torch

class QuantizedModelLoader:
    """
    A loader for quantized models saved in PyTorch's .pt format.
    This is a simplified representation from the OneCompression library.
    """

    @staticmethod
    def load_quantized_model_pt(model_dir: str):
        """
        Loads a quantized model from a .pt file in the specified directory.
        The file is expected to be named 'model.pt'.
        """
        model_path = os.path.join(model_dir, "model.pt")
        if not os.path.exists(model_path):
            raise FileNotFoundError(f"Model checkpoint not found at {model_path}")

        # VULNERABLE: torch.load uses Python's pickle, which can execute arbitrary code from a malicious model file.
        model_checkpoint = torch.load(model_path)

        # In a real implementation, the model would be constructed from the checkpoint.
        # For this example, we just return the loaded data.
        return model_checkpoint

import os
import torch

class QuantizedModelLoader:
    """
    A loader for quantized models saved in PyTorch's .pt format.
    This is a simplified representation from the OneCompression library.
    """

    @staticmethod
    def load_quantized_model_pt(model_dir: str):
        """
        Loads a quantized model from a .pt file in the specified directory.
        The file is expected to be named 'model.pt'.
        """
        model_path = os.path.join(model_dir, "model.pt")
        if not os.path.exists(model_path):
            raise FileNotFoundError(f"Model checkpoint not found at {model_path}")

        # FIX: Set weights_only=True to safely load only model tensors, disabling pickle's code execution capabilities.
        model_checkpoint = torch.load(model_path, weights_only=True)

        # In a real implementation, the model would be constructed from the checkpoint.
        # For this example, we just return the loaded data.
        return model_checkpoint

@misc{vaitp:cve202673325,
  title        = {{Unsafe deserialization in OneCompression allows RCE via a crafted model file.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-73325},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-73325/}}
}