Advisoriesby IbisPyTorchGHSA-rrmf-rvhw-rf47
PyTorch is vulnerable to memory corruption through its torch.jit.script function
Fix: upgrade to 2.13.0 or later
A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| torch PyPI | < 2.13.0 | 2.13.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-119
- Also known as
- BIT-pytorch-2025-3000, CVE-2025-3000, PYSEC-2025-194
- nvd.nist.gov/vuln/detail/CVE-2025-3000
- github.com/pytorch/pytorch/issues/149623
- github.com/pytorch/pytorch/issues/149623#issue-2935703015
- github.com/pytorch/pytorch/commit/b90c94991cdf8b87c8f7439f79518e0ef2c4ca4f
- github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-194.yaml
- github.com/pytorch/pytorch
- vuldb.com/?ctiid.302049
- vuldb.com/?id.302049
- vuldb.com/?submit.524197
More PyTorch advisories
All PyTorch
PyTorch: memory corruptionCVE-2025-3136no fix yetPyTorch: memory corruptionCVE-2025-3121no fix yetPyTorch is vulnerable to memory corruption through its torch.lstm_cell functionCVE-2025-3001fixed in 2.10.0PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence FunctionCVE-2025-2998no fix yetPyTorch is vulnerable to memory corruption through its unpack_sequence functionCVE-2025-2999fixed in 2.9.1PyTorch susceptible to local Denial of ServiceCVE-2025-2953fixed in 2.7.1-rc1