Description

Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-12T16:17:23.000Z",
  "pubdate": "2026-08-12T16:17:23.000Z",
  "executiveSummary": "Fujitsu Research's OneCompression version 1.2.0 suffers from an unsafe deserialization vulnerability residing in its model loading functionality. The vulnerability is triggered when the library processes a crafted model checkpoint file, allowing unauthenticated attackers to achieve arbitrary remote code execution. The root of the security flaw stems from the insecure usage of PyTorch's deserialization mechanisms, which instantiate Python's pickle module with unsafe parameters. By supplying a maliciously crafted model.pt file containing specially constructed object states, an attacker can coerce the application into executing arbitrary Python code and system-level commands upon loading the file. This poses severe risk implications, including complete system compromise, confidentiality breaches, and integrity loss of the underlying host environment. Exploitation requires the victim or the application to process an attacker-supplied model checkpoint from a caller-selected model directory. The vulnerability necessitates immediate remediation through secure deserialization practices or restricting the processing of untrusted model files.",
  "technicalDetails": "The vulnerability exists within the QuantizedModelLoader component of the OneCompression library, specifically inside the QuantizedModelLoader.load_quantized_model_pt() function. The root cause of the security defect is the unconditional invocation of torch.load with the parameter weights_only set to False. By explicitly disabling the weights-only restriction, the function falls back to utilizing Python's underlying pickle module for deserializing object graphs contained within the checkpoint file. Python's pickle module is inherently unsafe when handling untrusted data, as it allows the reconstruction of arbitrary Python objects through the execution of __reduce__ methods and associated callable hooks.\nThe attack flow proceeds as follows: an attacker crafts a malicious model.pt checkpoint file embedding a payload within a serialized object's __reduce__ method. This payload can encapsulate arbitrary Python code, such as OS command execution routines via the subprocess or os modules. The attacker then places this crafted file within a model directory accessible to the application or convinces a user/system to load the file using the vulnerable function. When QuantizedModelLoader.load_quantized_model_pt() processes the caller-selected model directory and invokes torch.load on the malicious model.pt file, the pickle machinery parses the byte stream and executes the embedded __reduce__ method.\nThe execution of the payload occurs with the privilege level of the process running the OneCompression library, which may lead to post-exploitation impacts such as reverse shells, data exfiltration, or lateral movement within the network. The vulnerable component is QuantizedModelLoader.load_quantized_model_pt() in OneCompression version 1.2.0. The attack vector requires the application to load a malicious checkpoint file provided by an untrusted source, meaning authentication or network exposure depends entirely on how the calling application exposes the model loading interface."
}