CVE-2025-27778: Applio Voice Conversion Tool RCE Vulnerability

CVE-2025-27778 Overview

CVE-2025-27778 is an insecure deserialization vulnerability affecting Applio, a popular open-source voice conversion tool. The vulnerability exists in infer.py and related components where unsafe torch.load() calls process untrusted model files without proper validation. This flaw allows attackers to craft malicious model files that execute arbitrary code when loaded by the application.

Critical Impact

Remote code execution through malicious model files, allowing complete system compromise when processing untrusted voice conversion models.

Affected Products

• Applio versions 3.2.8-bugfix and prior
• All Applio installations using vulnerable torch.load() calls without weights_only=True
• Components affected: rvc/infer/infer.py, tabs/inference/inference.py, tabs/tts/tts.py

Discovery Timeline

• 2025-03-19 - CVE-2025-27778 published to NVD
• 2025-08-01 - Last updated in NVD database

Technical Details for CVE-2025-27778

Vulnerability Analysis

This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a critical class of security flaws that occurs when applications process serialized data without proper validation. In Python machine learning applications, torch.load() uses Python's pickle module by default, which can execute arbitrary code during deserialization. Applio's voice conversion functionality requires loading pre-trained model files, and without the weights_only=True parameter, these model files become potential vectors for arbitrary code execution.

The vulnerability impacts multiple components within the Applio codebase, including the core inference engine (infer.py), the inference tab interface (inference.py), and the text-to-speech module (tts.py). Each of these components processes model files that could potentially come from untrusted sources, particularly in scenarios where users download community-created voice models.

Root Cause

The root cause is the use of torch.load() without the weights_only=True security parameter. When weights_only is not set to True, PyTorch's load function will deserialize arbitrary Python objects embedded in the model file using pickle, which is inherently unsafe for untrusted data. This allows attackers to embed malicious pickle payloads within seemingly legitimate model files.

Attack Vector

An attacker can exploit this vulnerability by creating a malicious voice model file containing a crafted pickle payload. When a victim loads this model in Applio—either through the web interface, command line, or by placing it in the models directory—the malicious payload executes with the privileges of the user running Applio. Attack scenarios include:

1. Distributing malicious voice models through community forums or model sharing platforms
2. Compromising legitimate model repositories to inject malicious payloads
3. Social engineering users to load attacker-controlled model files

The patched code adds the weights_only=True parameter to torch.load() calls:

# Vulnerable code pattern in tabs/inference/inference.py
def get_speakers_id(model):
    if model:
        try:
            model_data = torch.load(os.path.join(now_dir, model), map_location="cpu", weights_only=True)
            speakers_id = model_data.get("speakers_id")
            if speakers_id:
                return list(range(speakers_id))

Source: GitHub Commit

# Training module fix in rvc/train/train.py
def verify_checkpoint_shapes(checkpoint_path, model):
    checkpoint = torch.load(checkpoint_path, map_location="cpu", weights_only=True)
    checkpoint_state_dict = checkpoint["model"]
    try:
        if hasattr(model, "module"):

Source: GitHub Commit

Detection Methods for CVE-2025-27778

Indicators of Compromise

• Unexpected child processes spawned by the Applio Python process
• Network connections initiated from the Applio application to unknown external hosts
• Unusual file system modifications in the Applio directory or system directories
• Model files with abnormally large sizes or unexpected internal structures

Detection Strategies

• Monitor for torch.load() calls in Python processes without weights_only=True parameter
• Implement file integrity monitoring on model directories to detect unauthorized changes
• Review application logs for errors during model loading that may indicate malicious payloads
• Deploy endpoint detection to identify suspicious pickle deserialization patterns

Monitoring Recommendations

• Enable verbose logging for all model loading operations in Applio
• Configure alerts for any network activity originating from the Applio process
• Monitor system calls from the Applio process for unexpected execution patterns
• Audit model files before deployment using static analysis tools

How to Mitigate CVE-2025-27778

Immediate Actions Required

• Update Applio to the latest version from the main branch containing the security fixes
• Review all model files currently in use and verify their source integrity
• Restrict model loading to trusted, verified sources only
• Isolate Applio deployments in sandboxed environments where possible

Patch Information

The vulnerability has been addressed in commits to the Applio main branch. The fix adds weights_only=True to all torch.load() calls throughout the codebase. Users should pull the latest changes from the main branch as a numbered release with the fix was not available at the time of CVE publication.

Key commits addressing this vulnerability:

• Commit 16019be - Initial torch.load security fixes
• Commit eb21d9d - Additional torch.load fixes

For detailed technical information, see the GitHub Security Advisory.

Workarounds

• Run Applio in a containerized environment with limited privileges and network access
• Only load model files from verified, trusted sources with cryptographic signatures
• Implement file hash verification before loading any model files
• Use application sandboxing tools to restrict system access during model loading

# Configuration example - Running Applio in a restricted Docker container
docker run --rm -it \
  --network none \
  --read-only \
  --tmpfs /tmp \
  --security-opt no-new-privileges \
  -v /path/to/verified/models:/models:ro \
  applio:latest