~ / search / GHSA-c678-jfcj-6jmf

GHSA-c678-jfcj-6jmf

PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument

Source: GitHub Advisory Database (reviewed) Low CVE-2025-2148

Packages

EcosystemPackageAffectedFixed in
PyPI torch <= 2.6.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.

References

External links from the advisory. They lead to third-party sites.