CVE-2025-13711: Tencent TFace RCE Vulnerability

CVE-2025-13711 Overview

CVE-2025-13711 is a deserialization of untrusted data vulnerability in Tencent TFace, an open-source face recognition research toolkit. The flaw resides in the eval endpoint, where user-supplied data is passed to torch.load without proper validation. An attacker who convinces a target to visit a malicious page or open a crafted checkpoint file can execute arbitrary code in the context of the user running the process. Zero Day Initiative tracks this issue as ZDI-CAN-27187 and published advisory ZDI-25-1035. The vulnerability is classified under [CWE-502] Deserialization of Untrusted Data.

Critical Impact

Successful exploitation grants arbitrary code execution as root on systems processing untrusted TFace model checkpoints.

Affected Products

• Tencent TFace (face recognition research toolkit)
• TFace attribute/M3DFEL module (solver.py)
• TFace generation/uiface module (main.py)

Discovery Timeline

• 2025-12-23 - CVE-2025-13711 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13711

Vulnerability Analysis

The vulnerability stems from unsafe use of PyTorch's torch.load function within TFace's eval code paths. torch.load relies on Python's pickle module, which executes arbitrary constructors and callables embedded in the serialized stream. When TFace loads a checkpoint file provided or influenced by an attacker, the pickle deserialization process invokes attacker-controlled objects, resulting in remote code execution. Because TFace research pipelines commonly run with elevated privileges to access GPU devices and shared storage, the ZDI advisory notes that code executes in the context of root.

Root Cause

The root cause is the invocation of torch.load(args.resume, map_location='cuda:0') and equivalent calls without the weights_only=True argument. Prior to the patch, TFace deserialized full Python objects from checkpoint files rather than restricting deserialization to tensor weights. This behavior is a well-known pickle deserialization sink documented by the PyTorch project.

Attack Vector

Exploitation requires user interaction. An attacker crafts a malicious PyTorch checkpoint that contains a pickle payload with a __reduce__ method invoking arbitrary system commands. The attacker delivers the file through a shared model repository, phishing message, or malicious project page. When a researcher loads the checkpoint through TFace's resume or restore paths, the payload executes on their host.

# Vulnerable pattern (before patch) in attribute/M3DFEL/solver.py
if args.resume:
    checkpoint = torch.load(args.resume, map_location='cuda:0')
    # torch.load without weights_only=True executes pickle payloads
    print("=> loaded checkpoint '{}' (epoch {})".format(
        args.resume, checkpoint['epoch']))
    self.args.start_epoch = checkpoint['epoch'] + 1

Source: Tencent TFace commit 7b2eed2

Detection Methods for CVE-2025-13711

Indicators of Compromise

• Unexpected child processes spawned from Python interpreters running TFace training or evaluation scripts.
• TFace checkpoint files (.ckpt, .pt, .pth) originating from untrusted sources or arriving via email, chat, or public model hubs.
• Outbound network connections initiated by TFace processes immediately after a torch.load call.
• New shell processes, persistence entries, or SSH keys written by the account running TFace jobs.

Detection Strategies

• Static-scan TFace repositories for torch.load(...) calls that omit weights_only=True and flag them for review.
• Monitor Python processes for suspicious exec, os.system, subprocess.Popen, or socket activity following checkpoint loads.
• Inspect pickle streams inside checkpoint files for GLOBAL opcodes referencing modules such as os, posix, subprocess, or builtins.

Monitoring Recommendations

• Enable process-lineage logging on ML training hosts and alert when Python spawns shells or network utilities.
• Restrict egress traffic from GPU workstations and log outbound connections tied to interactive research sessions.
• Track file provenance for model checkpoints and require signature verification before loading third-party artifacts.

How to Mitigate CVE-2025-13711

Immediate Actions Required

• Update TFace to a build that includes commit 7b2eed297d43dcdd1e3d45bfdfc950478e3af5d9 or later.
• Audit all local torch.load invocations and add weights_only=True wherever untrusted checkpoints may be loaded.
• Quarantine any checkpoint files received from untrusted sources until they can be inspected.
• Run TFace training and evaluation jobs under a non-root service account with least-privilege file system access.

Patch Information

Tencent addressed the vulnerability in commit 7b2eed2. The patch adds weights_only=True to torch.load calls in attribute/M3DFEL/solver.py and generation/uiface/main.py, restricting deserialization to tensor weights and rejecting arbitrary pickle objects. Refer to ZDI-25-1035 for the coordinated advisory.

# Patched code in generation/uiface/main.py
@staticmethod
def restore_checkpoint(model, optimizer, path, lr_scheduler=None):
    model_ckpt = torch.load(
        os.path.join(path, "checkpoints", "model.ckpt"),
        map_location="cpu",
        weights_only=True,
    )
    optimization_ckpt = torch.load(
        os.path.join(path, "checkpoints", "optimization.ckpt"),
        map_location="cpu",
        weights_only=True,
    )

    global_step = optimization_ckpt["global_step"]

Source: Tencent TFace commit 7b2eed2

Workarounds

• Load only checkpoints produced internally or retrieved over authenticated, integrity-verified channels.
• Wrap torch.load in a helper that always sets weights_only=True and rejects unknown pickle globals.
• Execute untrusted evaluation jobs inside disposable containers or sandboxes without access to production credentials or data.

# Configuration example: sandbox TFace evaluations in a rootless container
docker run --rm \
  --user 1000:1000 \
  --network none \
  --read-only \
  --tmpfs /tmp \
  -v /path/to/checkpoints:/data:ro \
  tface:patched \
  python eval.py --resume /data/model.ckpt