CVE-2025-2953

PyTorch torch.mkldnn_max_pool2d denial of service

View on CVE.org
Published Mar 30, 2025 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The security policy of the project warns to use unknown models which might establish malicious effects.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-8684 A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The security policy of the project warns to use unknown models which might establish malicious effects.
Github GHSA Github GHSA GHSA-3749-ghw9-m3mg PyTorch susceptible to local Denial of Service
History
Type Values Removed Values Added
Description A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The security policy of the project warns to use unknown models which might establish malicious effects.
References
Type Values Removed Values Added
First Time appeared Linuxfoundation
Linuxfoundation pytorch
CPEs cpe:2.3:a:linuxfoundation:pytorch:2.6.0\+cu124:*:*:*:*:python:*:*
Vendors & Products Linuxfoundation
Linuxfoundation pytorch
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Title PyTorch torch.mkldnn_max_pool2d denial of service
Weaknesses CWE-404
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 22, 2025, 11:36 AM
Reserved
Mar 29, 2025, 7:35 PM

View source JSON

Updated
Mar 31, 2025, 1:06 PM

JSON

Status
Modified
Published
Mar 30, 2025, 4:15 PM
Modified
Jun 17, 2026, 9:07 AM

View source JSON

Severity
Low
Public date
Mar 30, 2025, 3:31 PM

View source Bugzilla JSON

No data.