CVE-2025-2998 | THREATINT

Description

A vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.pad_packed_sequence. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

In PyTorch 2.6.0 wurde eine kritische Schwachstelle ausgemacht. Betroffen ist die Funktion torch.nn.utils.rnn.pad_packed_sequence. Durch das Beeinflussen mit unbekannten Daten kann eine memory corruption-Schwachstelle ausgenutzt werden. Der Angriff muss lokal angegangen werden. Der Exploit steht zur öffentlichen Verfügung.

Reserved 2025-03-30 | Published 2025-03-31 | Updated 2025-03-31 | Assigner VulDB

MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

MEDIUM: 5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

MEDIUM: 5.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.3AV:L/AC:L/Au:S/C:P/I:P/A:P

Problem types

Memory Corruption

Timeline

2025-03-30:	Advisory disclosed
2025-03-30:	VulDB entry created
2025-03-30:	VulDB entry last update

Credits

Default436352 (VulDB User) reporter

References

vuldb.com/?id.302047 (VDB-302047 | PyTorch torch.nn.utils.rnn.pad_packed_sequence memory corruption) vdb-entry technical-description

vuldb.com/?ctiid.302047 (VDB-302047 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.524151 (Submit #524151 | pytorch torch 2.6.0 Segmentation fault) third-party-advisory

github.com/pytorch/pytorch/issues/149622 issue-tracking

github.com/pytorch/pytorch/issues/149622 exploit issue-tracking

cve.org (CVE-2025-2998)

nvd.nist.gov (CVE-2025-2998)

Download JSON