PYSEC-2025-194

At a glance

Published: 2025-03-31 15:15 UTC
Updated: 2026-07-13 16:45 UTC
CVE: CVE-2025-3000
Aliases: BIT-pytorch-2025-3000, GHSA-rrmf-rvhw-rf47
CVSS_V4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Affected packages

Package	Versions
PyPI · torch	introduced 0, last affected 2.6.0-NA

References

https://vuldb.com/?id.302049 ADVISORY
https://vuldb.com/?submit.524197 ADVISORY
https://github.com/pytorch/pytorch/issues/149623 REPORT
https://github.com/pytorch/pytorch/issues/149623#issue-2935703015 REPORT
https://vuldb.com/?ctiid.302049 REPORT
https://github.com/advisories/GHSA-rrmf-rvhw-rf47 ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database