CVE-2024-48063
Fixed upstream EPSS 2%
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
Products: pytorch
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | torch | 2.5.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | pytorch | no fix |
| Debian 13 | pytorch | no fix |
| Debian 14 | pytorch | no fix |
| Ubuntu 22.04 LTS | pytorch | no fix |
| Ubuntu 25.10 | pytorch | no fix |
| Ubuntu 26.04 LTS | pytorch | no fix |
| Ubuntu 26.10 | pytorch | no fix |