CVE-2026-123974
Received
Received - Intake
Predictable Temporary Directory in PyTorch TorchServe Local Privilege Escalation
Vulnerability report for CVE-2026-123974, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-06
Last updated on: 2026-11-06
Assigner: 7fefd608-56a6-419f-a002-fd8543c0710a
Description
Description
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| PyTorch | TorchServe | From 0 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-379 | The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file. |
