CVE-2026-73325: OneCompression Library RCE Vulnerability

CVE-2026-73325 Overview

CVE-2026-73325 is an unsafe deserialization vulnerability in Fujitsu Research's OneCompression library version 1.2.0. The flaw resides in QuantizedModelLoader.load_quantized_model_pt(), which calls torch.load with weights_only=False. This invokes Python's pickle machinery during model checkpoint deserialization. Attackers can embed a malicious __reduce__ method in a crafted model.pt file to execute arbitrary Python code when the library loads the checkpoint. The vulnerability maps to [CWE-502: Deserialization of Untrusted Data].

Critical Impact
A crafted PyTorch checkpoint loaded by OneCompression 1.2.0 achieves arbitrary code execution in the context of the invoking process, enabling system command execution and full compromise of confidentiality, integrity, and availability on the host.

Affected Products

Fujitsu Research OneCompression (onecomp) 1.2.0
Python environments installing onecomp from PyPI prior to 1.2.1
ML pipelines and applications loading third-party model.pt checkpoints via OneCompression

Discovery Timeline

2026-08-12 - CVE-2026-73325 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73325

Vulnerability Analysis

OneCompression is a Fujitsu Research library distributed on PyPI for compressing and quantizing machine learning models. Version 1.2.0 exposes a checkpoint loader, QuantizedModelLoader.load_quantized_model_pt(), that reads PyTorch .pt files from a caller-selected model directory.

The loader invokes torch.load without setting weights_only=True. In PyTorch, weights_only=False causes the loader to fall back to Python's pickle module for deserialization. pickle executes arbitrary callables described by __reduce__ methods embedded in the serialized object stream.

Because the loader accepts a model path controlled by the caller or a downstream data source, any attacker able to influence the file at that path can trigger arbitrary code execution when the checkpoint is loaded. Execution occurs in the Python process that imported OneCompression.

Root Cause

The root cause is unsafe use of torch.load(path, weights_only=False) on data that may originate from an untrusted source. PyTorch documentation explicitly warns that weights_only=False deserializes arbitrary Python objects via pickle and must not be used with untrusted files. OneCompression 1.2.0 does not validate, sandbox, or restrict the checkpoint contents before deserialization.

Attack Vector

Exploitation requires an attacker-controlled model.pt file to be loaded by an application using OneCompression. Typical delivery paths include shared model registries, community model hubs, supply-chain compromise of a model artifact, or a local user placing a file in a scanned model directory. When QuantizedModelLoader.load_quantized_model_pt() opens the file, the malicious pickle payload's __reduce__ method fires and runs Python code, including OS-level commands via os.system or subprocess. User interaction is required to trigger the load, and execution runs with the privileges of the calling process.

No verified public proof-of-concept code is referenced in the advisory. See the VulnCheck advisory on Fujitsu OneCompression for technical detail.

Detection Methods for CVE-2026-73325

Indicators of Compromise

Presence of onecomp version 1.2.0 in Python environments (pip show onecomp)
model.pt files sourced from untrusted repositories or shared directories that contain GLOBAL or REDUCE pickle opcodes referencing os, subprocess, posix, builtins.eval, or builtins.exec
Unexpected child processes such as sh, bash, cmd.exe, powershell.exe, or python spawned by an ML training or inference process shortly after a checkpoint load
Outbound network connections from ML worker processes to previously unseen hosts immediately following model loading

Detection Strategies

Scan Python dependency manifests, lockfiles, and installed site-packages for onecomp==1.2.0
Statically inspect .pt files with tools such as pickletools or fickling to flag dangerous opcodes before loading
Instrument endpoints to alert on process trees where a Python interpreter running ML workloads spawns shells or network utilities
Add EDR behavioral rules for python processes that read .pt files and subsequently execute os.system, subprocess.Popen, or write to autostart locations

Monitoring Recommendations

Log every invocation of torch.load in application code, capturing file path, caller, and the weights_only argument value
Monitor changes to model directories with file integrity monitoring, particularly writes by non-privileged users
Correlate ML job telemetry (checkpoint loads) with process and network telemetry to detect anomalous post-load behavior

How to Mitigate CVE-2026-73325

Immediate Actions Required

Upgrade onecomp to version 1.2.1 or later using pip install --upgrade onecomp
Audit all pipelines that call QuantizedModelLoader.load_quantized_model_pt() and identify the sources of every checkpoint they load
Quarantine model.pt files obtained from untrusted repositories or shared storage until they are validated
Restrict write access to model directories consumed by OneCompression to trusted service accounts only

Patch Information

A fixed release is available on PyPI as onecomp 1.2.1. Review the PyPI package overview for the latest version and release notes, and consult the VulnCheck advisory for full remediation guidance.

Workarounds

Load checkpoints only from cryptographically verified, first-party sources and enforce SHA-256 integrity checks before deserialization
Where feasible, wrap torch.load calls to force weights_only=True and reject files that require the legacy pickle path
Execute model loading inside a sandboxed process with no network access and minimal filesystem privileges to contain any residual exploitation
Use a pickle-scanning tool such as fickling in CI to reject checkpoints containing dangerous opcodes

bash

# Configuration example
pip install --upgrade 'onecomp>=1.2.1'
pip show onecomp | grep -i version