PT-2025-13780 · Pytorch+1 · Pytorch+1

Default436352 · Published 2025-03-31 · Updated 2025-05-30 · CVE-2025-2999

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PyTorch version 2.6.0

Description A critical vulnerability was found in PyTorch, affecting the function torch.nn.utils.rnn.unpack sequence. The manipulation of this function leads to memory corruption. Local attacks are required to exploit this issue. The exploit has been disclosed to the public and may be used.

Recommendations As a temporary workaround, consider disabling the torch.nn.utils.rnn.unpack sequence function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BIT-PYTORCH-2025-2999

CVE-2025-2999

PYSEC-2025-193

Affected Products

Debian

Pytorch

References · 17

• 🔥 https://github.com/pytorch/pytorch/issues/149622#issue-2935495265 · Exploit
• https://github.com/pytorch/pytorch/issues/149622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2999 · Security Note
• https://osv.dev/vulnerability/BIT-pytorch-2025-2999 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2999 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-2999 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2999 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-193 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2999 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-2999 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2999 · Vendor Advisory
• https://vuldb.com/?ctiid.302048 · Note
• https://twitter.com/CVEnew/status/1906721141466464273 · Twitter Post
• https://vuldb.com/?submit.524198 · Note
• https://t.me/cvedetector/21627 · Telegram Post