CVE-2025-2999 in PyTorch
Summary
by MITRE • 03/31/2025
A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/14/2026
The vulnerability in PyTorch 2.6.0 represents a critical memory corruption flaw within the torch.nn.utils.rnn.unpack_sequence function, which poses significant security risks to systems utilizing this machine learning framework. This issue affects the core functionality of recurrent neural network operations and demonstrates a fundamental weakness in how the library handles sequence unpacking operations. The vulnerability's classification as critical indicates its potential for severe impact on system integrity and stability.
The technical flaw stems from improper memory management within the unpack_sequence function, where inadequate bounds checking and memory allocation handling creates opportunities for buffer overflows or heap corruption. When processing sequences through this function, malicious inputs can trigger memory corruption that may lead to arbitrary code execution or system crashes. The local attack requirement suggests that exploitation typically necessitates access to the target system, though this does not mitigate the severity of the vulnerability given PyTorch's widespread use in development and production environments.
From an operational standpoint, this vulnerability impacts organizations relying on PyTorch for machine learning workloads, particularly those processing untrusted input data through recurrent neural network architectures. The public disclosure of exploitation techniques means that threat actors can readily leverage this vulnerability without requiring specialized knowledge or tools. Systems running PyTorch 2.6.0 with applications utilizing the affected function are at risk of being compromised, potentially leading to data breaches, service disruption, or further escalation within compromised environments.
The vulnerability aligns with CWE-121, which describes stack-based buffer overflow conditions, and may also relate to CWE-787, representing out-of-bounds write operations. From an attack framework perspective, this weakness maps to ATT&CK technique T1059.001 for command and script injection, as successful exploitation could enable attackers to execute arbitrary code on affected systems. Organizations should prioritize immediate patching of PyTorch installations to version 2.6.1 or later, which contains the necessary memory safety improvements. Additionally, implementing input validation measures and restricting execution privileges for PyTorch processes can help mitigate potential exploitation attempts while awaiting complete patch deployment across all affected systems.