Fujitsu OneCompression 1.2.0 Arbitrary Code Execution via torch.load Deserialization
VulnCheck advisory for CVE-2026-73325 (CVSS 8.4, CWE-502) in Fujitsu Research's OneCompression library version 1.2.0. The QuantizedModelLoader.load_quantized_model_pt() function unconditionally calls torch.load with weights_only=False, invoking Python's pickle deserialization on model checkpoint files. Attackers can embed malicious __reduce__ methods in a crafted model.pt checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory. Fixed in version 1.2.1 with an opt-in allow_unsafe_deserialization=True parameter; safetensors-based loading is recommended for untrusted models. Discovered by Nir Yehoshua from Cipher Security Labs and independently corroborated by the vendor's CHANGELOG.md.
Research notes
- Root causeQuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle deserialization on untrusted model checkpoint files.
- Technical detailAttackers can embed malicious __reduce__ methods in a crafted model.pt checkpoint to execute arbitrary Python code including system commands.
- MitigationFixed in OneCompression 1.2.1 with an opt-in allow_unsafe_deserialization=True parameter; recommends safetensors-based loading for untrusted models.