CVE-2026-108947 Details

A vulnerability exists in the torchdistill framework, specifically in versions up to 1.1.5, within the load_ckpt function of main_util.py. This flaw allows for arbitrary code execution through a deserialization vulnerability. The issue arises because the function loads local checkpoint files with the pickle deserializer re-enabled, creating an opportunity for malicious payloads to be executed. The vulnerability can be exploited by crafting a checkpoint file that includes a reduce method payload, which is then loaded by torchdistill using a user-specified YAML configuration. The problem is exacerbated by the fact that the checkpoint loading process does not verify the integrity or ownership of the files, leaving room for exploitation.

The vulnerability can be addressed by modifying the load_ckpt function to use the secure default for deserialization, which only loads weights and tensors, and by implementing checks for legacy files that may need to be re-saved with a trusted writer.