CVE-2026-15679

The EPSS-CVSS gap on CVE-2026-15679 is telling you something most organizations are ignoring: a CVSS 7.8 vulnerability with an EPSS score of 0.0044 is not a low-priority item—it is a lagging indicator. The low EPSS reflects that working exploits aren't yet circulating publicly, not that the vulnerability isn't real. The ZDI disclosure pathway has concluded, which means technical details exist in documented form. The clock on weaponization started at disclosure, not at the first PoC. The 'user interaction required' qualifier in the CVSS vector is structurally misaligned with how ML systems actually operate in production. When your HuggingFace model card loads weights automatically, when your CI pipeline pulls checkpoints from a shared registry, when your hyperparameter search spawns inference jobs across a cluster—the human in the loop is a build system, not a person reading a dialog box. The CVSS interaction model assumes friction. In automated ML environments, that friction has been delegated to scripts where the risk exposure is invisible. More fundamentally, this CVE exposes a design failure, not just a patchable bug. The timm library's `timm.create_model('resnet50', pretrained=True)` makes loading community weights from untrusted URLs functionally equivalent to loading them with full privilege—and it does so as the path of least resistance. The PyTorch ecosystem has `torch.load(weights_only=True)` to prevent this, but it is not the default, and the fragmented nature of ML tooling (Jupyter notebooks, custom training scripts, model registries, inference servers that never talk to each other) means the safe default propagates inconsistently across your infrastructure. What you should do now: audit every checkpoint-loading code path across your training scripts, inference services, and data pipelines for `torch.load` calls that lack `weights_only=True`—not just in timm, but in any library that wraps model loading. Enable sandboxing for any process that deserializes untrusted artifacts. Treat model registries as untrusted input sources and implement model signing or checksum verification before loading. The vulnerability in timm is one instance; the underlying pattern—pickle deserialization of untrusted data through convenience APIs—will recur. The fix is not patching this CVE. The fix is making safe checkpoint loading the default everywhere your organization loads model weights.

Reviewed through automated stages and approved by a human before publication.