CVE-2026-73325 in OneCompression
Summary
by MITRE • 08/12/2026
Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in Fujitsu Research's OneCompression library version 1.2.0 represents a critical unsafe deserialization flaw that enables remote code execution through maliciously crafted model files. This issue stems from the QuantizedModelLoader.load_quantized_model_pt() method which indiscriminately invokes torch.load with weights_only=False parameter, thereby exposing the application to pickle-based attacks. The vulnerability manifests when attackers supply a specially crafted model.pt checkpoint file containing malicious payload that exploits Python's pickle protocol during deserialization processes. This unsafe practice directly violates security best practices and creates a significant attack surface for adversaries seeking to compromise systems running vulnerable versions of the library.
The technical implementation of this vulnerability leverages Python's pickle module which is inherently dangerous when used without proper safeguards. When torch.load is called with weights_only=False, it permits deserialization of arbitrary Python objects including those containing malicious _reduce_ methods that can execute arbitrary code during the loading process. The QuantizedModelLoader component specifically fails to validate or sanitize input files before processing them, creating an uncontrolled execution path where attacker-controlled data flows directly into the pickle deserialization machinery. This design flaw allows attackers to embed system command execution payloads within the model checkpoint file itself, bypassing normal security boundaries and executing code with the privileges of the process loading the model.
The operational impact of this vulnerability extends beyond simple code execution to encompass complete system compromise and data exfiltration capabilities. Attackers can leverage this vulnerability to execute arbitrary commands on affected systems, potentially escalating privileges, establishing backdoors, or accessing sensitive data stored within the same environment. The vulnerability is particularly dangerous because it operates within a legitimate model loading workflow, making detection more challenging and allowing attackers to remain undetected while performing malicious activities. Systems utilizing the OneCompression library for machine learning model processing become vulnerable attack vectors that could be exploited in supply chain attacks or targeted compromises of AI/ML infrastructure.
Security mitigations for this vulnerability should focus on immediate parameter changes within the torch.load invocation to enforce weights_only=True, which would prevent deserialization of non-weight objects and eliminate the pickle-based attack surface. Organizations must also implement strict file validation procedures including cryptographic checksums and format verification before any model loading operations occur. Additionally, privilege separation techniques should be employed to ensure that model loading processes operate with minimal necessary permissions. From a compliance perspective, this vulnerability maps directly to CWE-502 which specifically addresses unsafe deserialization flaws, and aligns with ATT&CK technique T1059.001 for command and scripting interpreter usage, emphasizing the need for comprehensive defensive measures against pickle-based exploitation vectors in machine learning frameworks.