GitHub Advisoryadvisory · PyPI

GHSA-vgrw-7cvw-pwgx PyTorch is vulnerable to memory corruption through its unpack_sequence function

MEDIUM Published 2025-03-31 Modified 2026-06-10 Official page ↗
Aliases
CVE-2025-2999
Ecosystem
PyPI
Packages
torch
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-119
Reviewed
2026-06-10

Affected packages

• PyPI torch: < 2.9.1 → fixed in 2.9.1

Description

A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A patch is available through commit 4945180.

Related

Alias · CVE (1)

  • CVE-2025-2999 A vulnerability was found in PyTorch 2.6.0. vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References