SB2025120921 - Two memory corruption vulnerabilities in PyTorch

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2025-2999)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing untrusted input within the torch.nn.utils.rnn.unpack_sequence() function. A remote attacker can trick the victim into passing specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack. 

2) Buffer overflow (CVE-ID: CVE-2025-2998)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing untrusted input within the torch.nn.utils.rnn.pad_packed_sequence() function. A remote attacker can trick the victim into passing specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack. 

Remediation

Install update from vendor's website.

References

• https://github.com/pytorch/pytorch/issues/149622
• https://vuldb.com/?ctiid.302048
• https://github.com/advisories/GHSA-vgrw-7cvw-pwgx
• https://vuldb.com/?ctiid.302047
• https://github.com/advisories/GHSA-f4hp-rmr7-r7v8