CVE-2025-43846
📋 TL;DR
CVE-2025-43846 is a critical unsafe deserialization vulnerability in Retrieval-based-Voice-Conversion-WebUI that allows remote code execution. Attackers can exploit this by providing malicious model files that execute arbitrary code when loaded via torch.load. All users running vulnerable versions are affected.
💻 Affected Systems
- Retrieval-based-Voice-Conversion-WebUI
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the server, data theft, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to service disruption, data exfiltration, and cryptocurrency mining malware deployment.
If Mitigated
Limited impact with proper network segmentation and strict input validation preventing exploitation.
🎯 Exploit Status
No public exploit available yet, but the vulnerability is straightforward to exploit given the CVSS score and attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI/
Restart Required: Yes
Instructions:
No official patch exists. Monitor the GitHub repository for updates and apply immediately when available.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict validation of ckpt_path1 input to only allow known safe model files
# Modify process_ckpt.py to validate file paths before torch.load
Network Isolation
allRun the service in a restricted network environment with no internet access
# Use firewall rules to block all inbound/outbound except required ports
🧯 If You Can't Patch
- Disable the vulnerable feature or component entirely
- Implement strict network access controls and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check if using Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 or earlierCheck Version:
Check the version in the application files or configurationVerify Fix Applied:
Verify that the vulnerable code in process_ckpt.py has been updated to validate input before torch.load📡 Detection & Monitoring
Log Indicators:
- Unusual file paths in model loading operations
- Unexpected process execution from the voice conversion service
Network Indicators:
- Outbound connections to suspicious IPs from the service
- Unexpected data exfiltration patterns
SIEM Query:
process_name:"python" AND (process_args:"torch.load" OR process_args:"process_ckpt.py") AND file_path:contains(".pth")🔗 References
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/lib/train/process_ckpt.py#L53
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1439
- https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1444
- https://securitylab.github.com/advisories/GHSL-2025-012_GHSL-2025-022_Retrieval-based-Voice-Conversion-WebUI/
