CVE-2026-15531: HashNeRF-pytorch Use-After-Free Flaw

CVE-2026-15531 Overview

CVE-2026-15531 is an insecure deserialization vulnerability in the yashbhalgat HashNeRF-pytorch research project. The flaw resides in the torch.load call within run_nerf.py, part of the checkpoint file handler. An attacker who controls the ckpt_path argument can supply a crafted checkpoint file that triggers unsafe Python object deserialization when loaded. Exploitation requires local access and low privileges. The project uses a rolling release model, so no fixed version number is published, and a pull request addressing the issue is pending acceptance. This weakness is classified under CWE-20: Improper Input Validation.

Critical Impact
A local attacker supplying a malicious checkpoint file to torch.load can execute arbitrary Python code in the context of the user running the training or inference pipeline.

Affected Products

yashbhalgat HashNeRF-pytorch (rolling release, up to commit 82885e698295982504eb6a26d060a6b2473e3706)
Component: Checkpoint File Handler in run_nerf.py
Affected function: torch.load invoked on user-supplied ckpt_path

Discovery Timeline

2026-07-13 - CVE-2026-15531 published to NVD
2026-07-13 - Last updated in NVD database
Public disclosure occurred through GitHub Issue #49 and Pull Request #50

Technical Details for CVE-2026-15531

Vulnerability Analysis

HashNeRF-pytorch loads neural network checkpoints using PyTorch's torch.load function. By default, torch.load uses Python's pickle module to deserialize saved objects. The pickle format can execute arbitrary code during deserialization through __reduce__ methods embedded in the payload. When the application accepts a ckpt_path value pointing at an attacker-controlled file, loading that file executes any bundled payload.

The attack requires local access because the ckpt_path argument is typically passed via command-line configuration. However, the vector also extends to any workflow where a user downloads a shared checkpoint from an untrusted source. Model repositories, shared research artifacts, and collaborator handoffs all create realistic opportunities for a malicious pickle to reach a victim's disk.

Root Cause

The root cause is missing input validation on deserialized data [CWE-20]. run_nerf.py calls torch.load(ckpt_path) without restricting the pickle module's allowed globals and without switching to the safer weights_only=True mode introduced in modern PyTorch versions. There is no signature verification, no allow-listed class loader, and no sandboxing of the deserialization process.

Attack Vector

An attacker crafts a malicious .pt or .tar checkpoint file containing a Python class whose __reduce__ method returns an arbitrary command. The attacker then delivers the file to the victim via a shared drive, model hub, or repository. When the victim runs HashNeRF training or resumes from that checkpoint, torch.load deserializes the pickle payload and executes the embedded code with the victim's privileges. Refer to GitHub Issue #49 and the VulDB entry for CVE-2026-15531 for additional technical context. No verified proof-of-concept code is published in the enriched data set.

Detection Methods for CVE-2026-15531

Indicators of Compromise

Unexpected child processes spawned by Python interpreters that were invoked with run_nerf.py or similar HashNeRF entry points
Checkpoint files (.pt, .pth, .tar, .ckpt) sourced from untrusted origins present in the project directory
Outbound network connections originating from the training process to hosts unrelated to dataset or model servers

Detection Strategies

Scan Python code paths for calls to torch.load that lack weights_only=True and flag them during code review
Inspect checkpoint files with tools such as pickletools or fickling to identify suspicious opcodes like GLOBAL referencing os, subprocess, or builtins.eval
Correlate process telemetry to detect Python processes launching shells, package managers, or credential access utilities

Monitoring Recommendations

Log and alert on file creation events for checkpoint files written outside expected training output directories
Monitor for unexpected privilege changes or persistence artifacts created by machine learning workloads
Track downloads of model artifacts from external URLs and validate their integrity against publisher-provided hashes

How to Mitigate CVE-2026-15531

Immediate Actions Required

Do not load HashNeRF checkpoints received from untrusted sources until the upstream fix is merged
Modify local copies of run_nerf.py to pass weights_only=True to torch.load where the model contains only tensors
Isolate model training and inference workloads in dedicated non-privileged accounts or containers

Patch Information

No official release addresses CVE-2026-15531 at the time of publication. A fix is proposed in Pull Request #50 and awaits maintainer acceptance. Because the project follows a rolling release model, users should track the HashNeRF-pytorch repository and rebase to the commit that merges the fix.

Workarounds

Replace torch.load(ckpt_path) with torch.load(ckpt_path, weights_only=True) to restrict deserialization to tensor primitives
Verify checkpoint provenance using cryptographic hashes published by the original author before loading
Run HashNeRF inside a container or virtual machine with no access to sensitive credentials, keys, or production data
Prefer safer serialization formats such as safetensors for interchange of model weights

bash

# Configuration example: run HashNeRF in a restricted container
docker run --rm \
  --network=none \
  --read-only \
  --tmpfs /tmp \
  -v "$(pwd)/trusted_ckpts:/ckpts:ro" \
  -u 1000:1000 \
  hashnerf-pytorch:local \
  python run_nerf.py --config configs/scene.txt --ft_path /ckpts/verified.tar