CVE-2025-32434: checkpoint container bypassed weights_only in torch.load

CVE-2025-32434 (CVSS 9.3–9.8) in PyTorch up to 2.5.1 let legacy tar or bare-pickle checkpoints execute arbitrary code even under torch.load(weights_only=True). PyTorch 2.6.0 fixed the legacy path and made weights_only=True the default. A new static scanner, pytorch_checkpoint_scan.py, flags the container format with PTC001/PTC002/PTC010 checks.

• CVE-2025-32434: CVSS 9.3–9.8, affects PyTorch ≤ 2.5.1, fixed in 2.6.0
• Legacy tar and bare pickle bypassed the restricted unpickler under weights_only=True
• PyTorch 2.6.0 made weights_only=True the default
• pytorch_checkpoint_scan.py statically inspects containers without importing torch