CVE-2025-65213

CVE-2025-65213 is a critical unsafe deserialization vulnerability affecting all versions of MooreThreads torch_musa. Specifically, the compare_for_single_op() and nan_inf_track_for_single_op() functions in torch_musa.utils.compare_tool use pickle.load() on unvalidated user-controlled file paths. This allows an unauthenticated attacker to achieve remote code execution (RCE) with the privileges of the victim process by crafting and delivering a malicious pickle file. The vulnerability carries a CVSS score of 9.8 (CRITICAL) due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 11 mentions, indicating awareness among security researchers.