31 matches found
CVE-2025-32434
PyTorch contains a Remote Command Execution (RCE) vulnerability in versions 2.5.1 and earlier when loading a model with torch.load and weights_only=True. The issue is publicly documented and has been patched in version 2.6.0. External notices reiterate that upgrading to 2.6.0+ mitigates the flaw;...
CVE-2026-24747
PyTorch prior to v2.10.0 is vulnerable to memory corruption and potential arbitrary code execution via the weights_only unpickler when loading a malicious .pth checkpoint with torch.load(..., weights_only=True). Affected software is PyTorch (Python tensor computation package); the issue is fixed ...
CVE-2025-2953
CVE-2025-2953 affects PyTorch 2.6.0+cu124, specifically the mkldnn_max_pool2d function. The issue can lead to denial of service via local access, with an exploit publicly disclosed and the vulnerability’s real existence doubted in the description. The connected IBM bulletin references PyTorch in ...
CVE-2025-3001
CVE-2025-3001 affects PyTorch 2.6.0, specifically the torch.lstm_cell function, causing memory corruption. Exploitation requires LOCAL access, and public disclosures exist. Multiple connected sources confirm a patched version is available; remediation guidance is to upgrade to a patched release, ...
CVE-2025-3000
CVE-2025-3000 is confirmed to affect PyTorch 2.6.0, with the vulnerable component being the function torch.jit.script, leading to memory corruption. The IBM security bulletins in the connected documents validate a local-attack risk and note public exploits. Remediation is to upgrade affected IBM ...
CVE-2025-3730
CVE-2025-3730 affects PyTorch 2.6.0 in multiple IBM advisories and related deployments, notably the torch.nn.functional.ctc_loss path in LossCTC.cpp, which can cause local-denial-of-service. IBM docs consistently reference the same patching signal (46fc5d8e360127361211cb237d5f9eef0223e567) and pr...
CVE-2024-31580
PyTorch versions prior to v2.2.0 are vulnerable to a heap buffer overflow in the /runtime/vararg_functions.cpp component. This flaw allows an attacker to cause a Denial of Service (DoS) by providing a crafted input. Impacted products include Watson Machine Learning on Cloud Pak for Data (versions...
CVE-2024-31584
Pytorch versions before v2.2.0 are vulnerable to an Out-of-bounds Read flaw within the torch/csrc/jit/mobile/flatbuffer_loader.cpp component. The root cause is a missing validation for the mobile_ivalue_size_ variable against the ivalues->size() in the FlatbufferLoader::parseModule function, w...
CVE-2022-45907
CVE-2022-45907 is a PyTorch vulnerability where torch.jit.annotations.parse_type_line uses eval unsafely, enabling arbitrary code execution. Documented impact is high (CRITICAL, CVSS 3.1/3.0 vectors with 9.8 base score). Affected IBM products include Watson Studio for Cloud Pak for Data (versions...
CVE-2025-2149
CVE-2025-2149 affects PyTorch 2.6.0+cu124, specifically the Quantized Sigmoid Module’s nnq_Sigmoid func. The issue stems from improper initialization caused by manipulation of scale/zero_point, enabling a local attack with high attack complexity; exploitation has been disclosed. Connected IBM adv...
CVE-2025-2998
CVE-2025-2998 affects PyTorch 2.6.0, specifically the function torch.nn.utils.rnn.pad_packed_sequence, causing memory corruption. The issue requires local access; the exploit has been disclosed publicly. The provided documents do not specify a patched version or remediation steps. Monitor for upd...
CVE-2024-31583
The machine learning framework PyTorch (versions prior to v2.2.0 ) is vulnerable to a use-after-free flaw in the torch/csrc/jit/mobile/interpreter.cpp component. An attacker could exploit this by persuading a victim to open specially crafted content, potentially leading to arbitrary code executio...
CVE-2025-2148
CVE-2025-2148 : PyTorch 2.6.0+cu124 contains a vulnerability affecting torch.ops.profiler._call_end_callbacks_on_jit_fut in the Tuple Handler. Manipulating the argument None can cause memory corruption. The report notes a remote attack with high impact and high attack complexity; no explicit reme...
CVE-2026-4538
CVE-2026-4538 : PyTorch 2.10.0 contains a deserialization vulnerability in an unknown function of the pt2 Loading Handler. The issue can be exploited from a local environment and the exploit is publicly available. The description notes that the problem was reported via a pull request before the v...
CVE-2025-3136
CVE-2025-3136 is reported in PyTorch 2.6.0 affecting the function torch.cuda.memory.caching_allocator_delete in c10/cuda/CUDACachingAllocator.cpp. The issue causes memory corruption and requires local access to exploit; the exploit has been disclosed publicly. Connected sources corroborate the sa...
CVE-2025-2999
CVE-2025-2999 affects PyTorch 2.6.0, specifically the function torch.nn.utils.rnn.unpack_sequence, where manipulation leads to memory corruption. Exploitation requires local access; the exploit has been disclosed publicly. Multiple external sources in connected documents corroborate the local att...
CVE-2025-55551
CVE-2025-55551 affects PyTorch (torch.linalg.lu) and is described as an issue in PyTorch v2.8.0 where a slice operation can cause a Denial of Service. The connected IBM bulletin lists the Torch wheel (torch-2.9.1) among vulnerable dependencies, but the provided materials do not include explicit r...
CVE-2025-3121
CVE-2025-3121 affects PyTorch 2.6.0, specifically the function torch.jit.jit_module_from_flatbuffer. The manipulation can lead to memory corruption, requiring local access. The exploit has been disclosed publicly and may be used. The available connected documents corroborate the issue, its local ...
CVE-2025-55560
CVE-2025-55560 affects PyTorch where a model using torch.Tensor.to_sparse() and torch.Tensor.to_dense() compiled by Inductor can cause a DoS. Connected advisories specify affected package versions: PyTorch < 2.0.0-11 and PyTorch
CVE-2025-55553
CVE-2025-55553 is described across sources as a DoS vulnerability in PyTorch v2.7.0 caused by a syntax error in the proxy_tensor.py component. The linked documents (NVD/NIST entry and IBM watsonx bulletin listing this CVE among PyTorch-related issues) confirm the affected product and the basic fl...
CVE-2025-46150
In PyTorch versions prior to 2.7.0 , using torch.compile with the FractionalMaxPool2d component leads to inconsistent results . While one source suggests an information disclosure vulnerability, specific technical details regarding the root cause or exploitation are not fully provided. Additional...
CVE-2025-55554
The PyTorch machine learning framework, specifically version v2.8.0 , is vulnerable to an integer overflow in the torch.nan_to_num-.long() component. A malicious actor could exploit this vulnerability to trigger a service failure . While the core cause is identified as an integer overflow, specif...
CVE-2025-46148
The PyTorch machine learning framework is affected by a vulnerability in versions through 2.6.0 . When using eager mode , the nn.PairwiseDistance(p=2) configuration produces incorrect results due to insufficient validation of input data . This flaw could allow an attacker to compromise the confid...
CVE-2025-55557
CVE-2025-55557 : A NameError occurs in PyTorch v2.7.0 when a model uses torch.cummin and is compiled by Inductor, leading to a Denial of Service. The initial description provides the affected components and the root cause, but no public remediation or exploitation details are documented in the su...
CVE-2025-55558
A buffer overflow vulnerability exists in pytorch v2.7.0 caused by a boundary error during model compilation when handling untrusted input. The flaw is triggered when a model contains a specific combination of torch.nn.Conv2d , torch.nn.functional.hardshrink , and torch.Tensor.view-torch.mv() and...
CVE-2025-46152
The PyTorch machine learning framework contains a security vulnerability in the torch.bitwise_right_shift interface. The flaw occurs because the function mishandles out-of-bounds values for the **
CVE-2025-55552
CVE-2025-55552 concerns PyTorch v2.8.0 exhibiting unexpected behavior when using torch.rot90 and torch.randn_like together. The primary sources state the issue exists in PyTorch 2.8.0 and provide no explicit remediation in the initial description. Some connected advisories note that patched versi...
CVE-2025-46149
The PyTorch machine learning framework (versions before 2.7.0 ) contains a vulnerability where the nn.Fold module triggers an assertion error when the inductor is used. While some reports suggest this could lead to a denial-of-service attack or is related to buffer overflow issues, specific detai...
CVE-2025-46153
The PyTorch machine learning framework (versions before 3.7.0 ) contains a vulnerability in the bernoulli_p decompose function located in decompositions.py . The issue stems from a lack of full consistency with the eager CPU implementation, which negatively impacts nn.Dropout1d , nn.Dropout2d , a...
CVE-2025-63396
An issue in PyTorch versions v2.5 and v2.7.1 allows for a Denial of Service (DoS) . The root cause is the omission of profiler.stop(), which can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization. This vulnerability affects the IBM Robotic Process Automation for Clou...