CVE-2025-3001 in PyTorch
Summary
by MITRE • 03/31/2025
A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/11/2026
The vulnerability in PyTorch 2.6.0 represents a critical memory corruption issue within the torch.lstm_cell function that poses significant security risks to machine learning applications. This flaw exists in the deep learning framework's implementation of long short-term memory cell operations, which are fundamental components in neural network architectures. The vulnerability's classification as critical indicates the potential for severe system compromise, particularly given that the exploit has been publicly disclosed and is considered usable by threat actors. The local attack requirement means that an adversary must already have access to the system where PyTorch is running, typically through legitimate user credentials or compromised accounts with execution privileges.
The technical nature of this vulnerability stems from improper memory management within the LSTM cell implementation, where the torch.lstm_cell function fails to properly validate input parameters or manage memory allocation during computation. This memory corruption can manifest through buffer overflows, use-after-free conditions, or other memory safety issues that occur when the function processes specific input sequences or parameter combinations. The flaw likely occurs during the internal tensor operations that LSTM cells perform, particularly when handling recurrent connections and state updates. Such memory corruption vulnerabilities are particularly dangerous because they can lead to arbitrary code execution, data corruption, or system instability when exploited. The vulnerability aligns with CWE-121, which covers stack-based buffer overflow conditions, and CWE-122, which addresses heap-based buffer overflow issues that are common in memory management flaws.
The operational impact of this vulnerability extends beyond simple system crashes or data corruption, as it affects the integrity and security of machine learning workloads that rely on PyTorch's LSTM implementations. Organizations using PyTorch for sensitive applications such as financial modeling, healthcare analytics, or autonomous systems face potential risks where an attacker could manipulate neural network computations to produce incorrect outputs or gain unauthorized access. The local attack vector means that the vulnerability is most concerning in environments where multiple users share systems or where privilege escalation is possible, as it could allow attackers to move laterally within a network or escalate their privileges. This vulnerability particularly impacts research institutions, cloud computing environments, and enterprises that deploy PyTorch-based models in production systems where security is paramount.
Mitigation strategies for this vulnerability must include immediate patching of PyTorch to versions that address the memory corruption issue in torch.lstm_cell functionality. Organizations should also implement runtime monitoring and input validation measures to detect anomalous behavior in LSTM operations, particularly when processing untrusted data inputs. System hardening measures such as address space layout randomization, stack canaries, and memory protection mechanisms can provide additional layers of defense against exploitation attempts. Security teams should conduct comprehensive vulnerability assessments of all PyTorch-based applications and implement least privilege access controls to limit potential attack surfaces. The ATT&CK framework's T1059.001 technique for command and scripting interpreter execution could be relevant in monitoring for exploitation attempts, while T1566.001 covering spearphishing with a malicious attachment might apply if attackers attempt to deliver malicious models or data that trigger the vulnerability. Regular security updates, proper access controls, and monitoring for unusual computational patterns in neural network processing should form part of the overall security posture to protect against this and similar vulnerabilities.