← Vulnerability feed

Vulnerability record · CVE-2025-3730 · published 16 April 2025

CVE-2025-3730: Linuxfoundation pytorch improper resource shutdown vulnerability

Linuxfoundation · Pytorch

A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue. The security policy of the project warns to use unknown models which might establish malicious effects.

4.8 CVSS 4.0 Medium EPSS 0.33% · top 76.2% CWE-404 · Improper resource shutdown
4.8CVSS 4.0 base score, v2 1.7
0.33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue. The security policy of the project warns to use unknown models which might establish malicious effects.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pytorch/pytorch/issues/150835 ExploitIssue TrackingVendor Advisory
https://github.com/pytorch/pytorch/issues/150835#issue-2979082232 ExploitIssue TrackingVendor Advisory
https://github.com/pytorch/pytorch/pull/150981 Issue TrackingPatch
https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e360127361211cb237d5f9eef0223e567 Patch
https://vuldb.com/?ctiid.305076 Permissions RequiredVDB Entry
https://vuldb.com/?id.305076 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.553645 ExploitThird Party AdvisoryVDB Entry
https://github.com/pytorch/pytorch/issues/150835 ExploitIssue TrackingVendor Advisory

Track CVE-2025-3730 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-48063Linuxfoundation pytorch deserialization of untrusted data vulnerabilityIn PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch…EPSS 1.6%9.8CVE-2022-45907Linuxfoundation pytorch code injection vulnerabilityIn PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.EPSS 1.3%9.3CVE-2025-32434Linuxfoundation pytorch deserialization of untrusted data vulnerabilityPyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd sys…EPSS 2.2%8.8CVE-2026-24747Linuxfoundation pytorch code injection vulnerabilityPyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows a…EPSS 0.81%7.8CVE-2024-31583Linuxfoundation pytorch use after free vulnerabilityPytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.EPSS 0.27%7.5CVE-2025-55560Linuxfoundation pytorch uncontrolled resource consumption vulnerabilityAn issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense(…EPSS 0.41%7.5CVE-2025-55552Linuxfoundation pytorch integer overflow vulnerabilitypytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.EPSS 0.42%7.5CVE-2025-55553Linuxfoundation pytorch vulnerabilityA syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).EPSS 0.41%

Source: NIST National Vulnerability Database (record CVE-2025-3730), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.