CVE-2025-4287 Details
Description
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.
A denial-of-service vulnerability has been identified in PyTorch versions 2.6.0 and later, specifically in the CUDA NCCL reduce function. The issue arises when the function is called with invalid operation codes, causing the program to crash with a core dump instead of properly validating the input or raising an appropriate error. This vulnerability can be exploited locally.
Users can upgrade to the patched version of PyTorch, which includes validation checks for the NCCL reduce operation codes, preventing the use of invalid codes that could lead to a crash.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 5, 2025CISA-ADP
Assessed May 6, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Divigroup-RAP/PYTORCH/commit/5827d2061dcb4acd05ac5f8e65d8693a481ba0f5 | [email protected] | Source Code |
| https://github.com/pytorch/pytorch/issues/150836 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/pytorch/pytorch/issues/150836#issue-2979097872 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/pytorch/pytorch/pull/150923 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/?ctiid.307394 | [email protected] | Content Wall |
| https://vuldb.com/?id.307394 | [email protected] | Content Wall |
| https://vuldb.com/?submit.553644 | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Divigroup-RAP PyTorch | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2025 | New CVE Received | [email protected] |