Improper locking in PyTorch - CVE-2025-63396

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU123582

Improper locking in PyTorch - CVE-2025-63396

Published: March 5, 2026


Vulnerability identifier: #VU123582
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-63396
CWE-ID: CWE-667
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.

The vulnerability exists due to the omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization. An authenticated local user with physical access to the system can exploit this vulnerability to cause a deadlock, resulting in a denial of service condition.


Affected software

PyTorch
watsonx Code Assistant On Prem

How to mitigate CVE-2025-63396

Install updates from vendor's website.

PyTorch - addressed in versions 2.5.1, 2.8.0
watsonx Code Assistant On Prem - update to 5.3.1

External References

Related Security Bulletins