Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses PyTorch 2.6.0 which is vulnerable to CVE-2025-2998, CVE-2025-2999, CVE-2025-55552,CVE-2025-63396,CVE-2025-55551

Summary IBM Maximo Application Suite - Visual Inspection component uses PyTorch 2.6.0 which is vulnerable to CVE-2025-2998, CVE-2025-2999, CVE-2025-55552,CVE-2025-63396,CVE-2025-55551. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details...

CVE-2025-2998

A vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.padpackedsequence. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the...

dleamse (>=0.2.1, <=0.3.6), gcgc (>=0.2.3, <=0.2.4) +9 more potentially affected by CVE-2025-2998 via torch (1.0.0)

torch PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - dleamse =0.2.1, =0.2.3, =0.3.1, =0.0.1.0, =0.2.3.1, =0.1.0a1, =0.1.0, =0.1.42 Source cves: CVE-2025-2998 Source advisory: OSV:GHSA-F4HP-RMR7-R7V8...

akkadian (>=1.0.2, <=1.0.12), allennlp (0.8.5) +22 more potentially affected by CVE-2025-2998 via torch (1.1.0)

torch PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - akkadian =1.0.2, =0.8.5.dev201908202300, =0.0.6, =0.1.0, =0.6.8, =0.1.0, =0.2.0, =0.3.0 and more Source cves: CVE-2025-2998 Source advisory:...

alfworld (>=0.2.2rc1, <=0.2.2), atacworks (>=0.3.0, <=0.3.3) +31 more potentially affected by CVE-2025-2998 via torch (1.2.0)

torch PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - alfworld =0.2.2rc1, =0.3.0, =0.0.2.dev0, =3.0.0b34, =0.5.0, =0.1.0, =0.1.6, =0.0.2, =0.1.1.dev0, =0.1.1, =0.1.4 - mars-gym 0.1.0 - natas 1.0.6 -...

azureml-designer-pytorch-modules (>=0.0.1, <=0.0.12), deberta (0.1.4) +10 more potentially affected by CVE-2025-2998 via torch (1.3.0)

torch PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - azureml-designer-pytorch-modules =0.0.1, =0.0.3, =1.3.0, =0.1.0, =0.1.0, =0.2.0a2, =0.1.0, =0.1.1 Source cves: CVE-2025-2998 Source advisory:...

aum (>=1.0.0, <=1.0.1), blitz-bayesian-pytorch (0.2.0) +41 more potentially affected by CVE-2025-2998 via torch (1.3.1)

torch PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - aum =1.0.0, =0.3.0, =0.6.1, =0.1.0rc3, =0.0.1, =0.3.2, =0.0.1, =0.1.2, =0.0.6, =0.0.8 and more Source cves: CVE-2025-2998 Source advisory:...

abdothebest (>=0.7.4, <=0.9.9), adafdr (0.1.8) +116 more potentially affected by CVE-2025-2998 via torch (1.4.0)

torch PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - abdothebest =0.7.4, =0.9.1.dev20200302, =1.2.0, =0.1.4, =0.1.1, =0.0.5, =1.0.0, =0.2.3, =0.2.0, =0.2.3 and more Source cves: CVE-2025-2998 Source...

adafmnoisereducer (1.0.2), aihwkit (0.2.1) +91 more potentially affected by CVE-2025-2998 via torch (1.6.0)

torch PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - adafmnoisereducer 1.0.2 - aihwkit 0.2.1 - allennlp =1.1.0rc2, =1.1.0rc2, =0.1.1.dev1, =1.0.1, =0.2.1, =0.0.1, =0.0.2.5, =0.2.4, =1.4.2, =0.0.5, =0.1.0...

ai-projects (>=0.0.1, <=0.0.4), allencv (>=0.1.2, <=0.1.3) +191 more potentially affected by CVE-2025-2998 via torch (1.7.1)

torch PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - ai-projects =0.0.1, =0.1.2, =1.2.0, =0.0.3, =1.2.0, =1.37.0, =0.0.2, =1.0.0, =0.6.6, =0.2.0, =0.2.1 - bento-tools 0.1.0 and more Source cves:...

afrotranslate (>=0.0.1, <=0.0.6), ai-traineree (0.0.13) +35 more potentially affected by CVE-2025-2998 via torch (1.8.0)

torch PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - afrotranslate =0.0.1, =1.4.0, =0.7.5, =0.2.0, =0.0.7, =0.0.1, =0.1.0, =4.0.0, =0.0.1, =1.0.0, =1.2.0 - handobjectacb 0.1.3 - hummingbird-ml 0.2.2 and...

aihwkit (>=0.3.0, <=0.6.0), aiqc (>=2.1.0, <=7.1.5) +133 more potentially affected by CVE-2025-2998 via torch (1.8.1)

torch PYPI version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - aihwkit =0.3.0, =2.1.0, =2.2.0, =2.2.0, =0.2.2, =0.0.4, =0.7.0, =1.34.0, =0.0.1, =0.1.0, =3.0.0, =3.2.1 and more Source cves: CVE-2025-2998 Source...

agent-smith (0.1.1), aislib (0.1.5a0) +90 more potentially affected by CVE-2025-2998 via torch (1.9.0)

torch PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - agent-smith 0.1.1 - aislib 0.1.5a0 - aixlab-cn-pre 0.1.0 - audacitorch =0.0.1, =0.1.2, =1.0.2, =1.35.0, =0.0.1rc19, =0.0.1rc158956732038 and more Sour...

3d-connectx-env (>=1.0.0, <=1.0.1), ai-traineree (>=0.1.2, <=0.4.2) +80 more potentially affected by CVE-2025-2998 via torch (1.9.1)

torch PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - 3d-connectx-env =1.0.0, =0.1.2, =2.5.1.dev20210621, =2.5.1.dev20210621, =0.1.0, =0.0.9, =0.1.0.dev2021118, =0.1.6, =0.1.7 and more Source cves:...

adaptnlp (>=0.3.6, <=0.3.7), adbdgl-adapter (>=1.0.0, <=1.0.2) +44 more potentially affected by CVE-2025-2998 via torch (1.10.0)

torch PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - adaptnlp =0.3.6, =1.0.0, =0.0.1, =0.0.5, =1.0.0, =1.38.1, =0.2.1, =0.0.3.post3, =0.1.0, =0.0.48, =0.0.59 and more Source cves: CVE-2025-2998 Source...

4996 (>=0.1.0, <=0.1.1), ablation (0.1.0) +30 more potentially affected by CVE-2025-2998 via torch (1.10.1)

torch PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - 4996 =0.1.0, =0.1.13, =2.0.0rc1, =0.0.1, =0.3.3, =0.1.0, =0.5.0, =0.6.0 and more Source cves: CVE-2025-2998 Source advisory: OSV:GHSA-F4HP-RMR7-R7V8...

adaswarm (>=0.0.1, <=0.0.2), allennlp (>=2.8.0, <=2.9.1) +80 more potentially affected by CVE-2025-2998 via torch (1.10.2)

torch PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - adaswarm =0.0.1, =2.8.0, =2.8.0, =0.1.0, =0.2.1b20210731, =0.4.3b20220616, =0.3.2b20220222, =1.0.0, =1.40.0, =0.1.0, =0.1.2, =0.2.8 -...

aima (2023.2.4), aine-drl (0.1.1) +174 more potentially affected by CVE-2025-2998 via torch (1.11.0)

torch PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - aima 2023.2.4 - aine-drl 0.1.1 - allennlp =2.9.2, =2.9.3, =0.1.0, =0.1.2, =1.0.0, =0.1.1, =0.4.3b20220621, =0.4.3b20220621, =0.4.3b20220621,...

adaseq (>=0.4.0, <=0.6.3), aipalette-nlp (>=0.0.9, <=0.1.0) +209 more potentially affected by CVE-2025-2998 via torch (1.12.1)

torch PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - adaseq =0.4.0, =0.0.9, =1.0.0, =0.1.0, =0.1.0, =0.0.3, =0.1.0, =0.0.3, =0.0.1, =0.0.1, =0.1.1 and more Source cves: CVE-2025-2998 Source advisory:...

abimca (>=0.2.4, <=0.2.5), ablator (>=0.0.1b1, <=0.0.1b2) +845 more potentially affected by CVE-2025-2998 via torch (1.13.1)

torch PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - abimca =0.2.4, =0.0.1b1, =1.0.32, =0.0.3, =2.1.17, =0.0.0.dev1, =0.2.0, =0.1.0, =0.0.15, =0.1.0, =0.1.7 and more Source cves: CVE-2025-2998 Source...