# ModelCache torch.load() Deserialization RCE (CVE-2025-45146)

- **Severity:** Critical
- **Signature ID:** `2a733fa3-c532-44ed-86cd-19bb8744da68`
- **CVEs:** CVE-2025-45146
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0011.000 (Unsafe AI Artifacts)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI05 (Cascading Failures in Multi-Agent Systems), LLM03 (Supply Chain), LLM05 (Improper Output Handling)

## Summary

ModelCache, a caching layer used with LLMs, loads cached data using PyTorch's torch.load() function without safety checks. Because that function can execute arbitrary code embedded in a file, an attacker who can supply or tamper with cached data can take over the server that runs it.

## How the attack works

ModelCache versions through 0.2.0 use torch.load() in its data manager to deserialize stored cache entries. torch.load() relies on Python's pickle format, which supports a __reduce__ mechanism that runs arbitrary code as soon as the object is loaded. An attacker crafts a malicious pickle/torch file and gets it into the cache path (for example via a poisoned model, a shared cache store, or a network-accessible data source ModelCache reads from). When ModelCache loads that data, the embedded code executes with the privileges of the ModelCache process.

## Why it matters

Successful exploitation gives an attacker arbitrary code execution on the host running ModelCache, which can lead to full compromise of the service, theft of cached data or credentials, and a foothold for further movement into connected AI infrastructure.

## What you can do

- Upgrade ModelCache past version 0.2.0 or patch the data_manager.py deserialization path.
- Never load cache files or model artifacts from untrusted or externally writable locations.
- Replace torch.load() calls with weights_only=True or migrate to a non-pickle serialization format for cached data.
- Restrict write access to any storage or network path that ModelCache reads cache entries from.

## Known benign look-alikes

- Defensive guidance recommending weights_only=True for torch.load.
- Static analysis output reporting pickle.load usage in code review.
- Educational examples demonstrating pickle exploit theory in academic contexts.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00433
- https://nvd.nist.gov/vuln/detail/CVE-2025-45146

---
Source: https://www.netzilo.com/threats/atr-modelcache-torch-load-deserialization-rce-cve-2025-45146