Vulnerability · Published Mar 10, 2025 · Assigned by VulDB
CVE-2025-2148PyTorch Tuple torch.ops.profiler._call_end_callbacks_on_jit_fut memory corruption
Medium 5.0
In plain English
A medium-severity memory corruption in PyTorch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pytorch | no fix listed | DEBIAN-CVE-2025-2148 |
| Debian:13 | pytorch | no fix listed | DEBIAN-CVE-2025-2148 |
| Debian:14 | pytorch | no fix listed | DEBIAN-CVE-2025-2148 |
| PyPI | torch | no fix listed | GHSA-c678-jfcj-6jmf |
| PyPI | torch | no fix listed | PYSEC-2025-189 |
| Ubuntu:22.04:LTS | pytorch | no fix listed | UBUNTU-CVE-2025-2148 |
| Ubuntu:25.10 | pytorch | no fix listed | UBUNTU-CVE-2025-2148 |
| Ubuntu:26.04:LTS | pytorch | no fix listed | UBUNTU-CVE-2025-2148 |
| Ubuntu:26.10 | pytorch | no fix listed | UBUNTU-CVE-2025-2148 |
Affected products (as reported)
Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- VDB-299059 | PyTorch Tuple torch.ops.profiler._call_end_callbacks_on_jit_fut memory corruption vdb-entry, technical-description
- VDB-299059 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #505959 | pytorch 2.6.0+cu124 Segmentation fault third-party-advisory
- https://github.com/pytorch/pytorch/issues/147722 issue-tracking