Answer in brief
CVE-2026-73325 records a High severity (CVSS 7.8) vulnerability in Fujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load Deserialization. The current sources do not mark it as known exploited. The current feed maps Fujitsu Research/OneCompression (generic), Fujitsu Research/OneCompression (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Fujitsu Research/OneCompression (generic), Fujitsu Research/OneCompression (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Fujitsu Research/OneCompressiongeneric | 0 | Not reported |
| Fujitsu Research/OneCompressiongeneric | >=0 <1.2.1 | 1.2.1 |
Published upstream
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 12, 2026
Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.
Quoted source text, attributed separately from HOL analysis.