PyTorch safe checkpoint loader can expose process heap

PyTorch's documented safe path for loading untrusted model checkpoints can still expose leftover process memory, according to a report filed against the project.

Since version 2.6.0, torch.load defaults to a weights-only mode meant to rebuild tensors from a restricted set of types and refuse arbitrary pickle code. The report says a crafted checkpoint stays inside that allowlist and still comes back as a tensor whose storage was allocated and never filled. The values are whatever was already on the process heap. No attacker code runs inside the loader; the disclosure is the uninitialized bytes, and the checkpoint author chooses how large the allocation is.

A normal checkpoint fills storage from the file's tensor data. The reported construction asks for storage by size alone, then wraps it as a tensor. CPU allocation does not clear that memory unless a separate allocator flag is on, and that flag is off by default. An earlier change closed a similar uninitialized-state bug on a different construction path in the same loader; this storage path was left open.

The filing includes a self-contained reproducer. No fix or CVE identifier was published with it.