PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in
    PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that,
    when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to
    arbitrary code execution. Version 2.10.0 fixes the issue. (CVE-2026-24747)

The remote NewStart CGSL host, running version MAIN 7.02, has pytorch packages installed that are affected by a vulnerability:

  - PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in     PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that,     when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to     arbitrary code execution. Version 2.10.0 fixes the issue. (CVE-2026-24747)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in     PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that,     when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to     arbitrary code execution. Version 2.10.0 fixes the issue. (CVE-2026-24747)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459835	Echo: pytorch: security update to 2.12.0+dfsg2-1	Tenable Cloud Security	Echo Local Security Checks	Local	high
459835	Echo: pytorch: security update to 2.12.0+dfsg2-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
343553	NewStart CGSL MAIN 7.02 : pytorch Vulnerability (NS-SA-2026-0105)	Nessus	NewStart CGSL Local Security Checks	Local	high
437368	SCA: security update for pytorch (GHSA-63cw-57p8-fm3p)	Tenable Cloud Security	SCA Checks	Local	high
437368	SCA: security update for pytorch (GHSA-63cw-57p8-fm3p)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
297037	Linux Distros Unpatched Vulnerability : CVE-2026-24747	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-24747

high

Tenable Plugins

high

high

high

high

high

high