Tencent Hunyuan3D-1 Remote Code Execution Vulnerability via Deserialization in load_pretrained Function

A remote code execution vulnerability has been identified in Tencent Hunyuan3D-1. This issue arises from the load_pretrained function's improper validation of user-supplied data, allowing for the deserialization of untrusted data. As a result, remote attackers can execute arbitrary code on affected installations, with the executed code running in the context of root. Exploitation requires user interaction, as the target must visit a malicious page or open a malicious file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running as the root user.

Remediation

Tencent has released a patch for this vulnerability. Details about the update can be found in the official GitHub repository.