VDB
CVE-2025-3730
CVE-2025-3730
PUBLISHED
CVSS 4.800000190734863 MEDIUM
A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue. The security policy of the project warns to use unknown models which might establish malicious effects.
EPSS 0.33% · 23.7th percentile
Risk Scores
CVSS 4.0
4.800000190734863
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score
0.33%
23.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | pytorch | 2.6.0 |
| Bitnami | pytorch | 2.6.0 |
Timeline
- Apr 16, 2025 CVE Published
- Apr 17, 2025 EPSS Score
- Apr 30, 2025 EPSS Score
- May 11, 2025 Coalition ESS Score
- May 12, 2025 EPSS Score
- May 25, 2025 EPSS Score
- Jun 7, 2025 EPSS Score
- Jun 15, 2025 Coalition ESS Score
- Jun 20, 2025 EPSS Score
- Jul 2, 2025 EPSS Score
- Jul 15, 2025 EPSS Score
- Jul 28, 2025 EPSS Score
References
- https://github.com/pytorch/pytorch/issues/150835 discussion
- https://github.com/pytorch/pytorch/issues/150835#issue-2979082232 discussion
- https://github.com/pytorch/pytorch/pull/150981 fix
- https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e360127361211cb237d5f9eef0223e567 fix
- https://vuldb.com/?id.305076 url
- https://vuldb.com/?submit.553645 url
- https://vuldb.com/?ctiid.305076 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-3730 url