CVE-2025-2953PyTorch torch.mkldnn_max_pool2d denial of service

Description

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The security policy of the project warns to use unknown models which might establish malicious effects.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• VDB-302006 | PyTorch torch.mkldnn_max_pool2d denial of service vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
• VDB-302006 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-requiredPermissions RequiredVDB Entry
• Submit #521279 | pytorch PyTorch version: 2.6.0+cu124 Floating point exception third-party-advisoryThird Party AdvisoryVDB Entry
• https://github.com/pytorch/pytorch/issues/149274 issue-trackingExploitIssue Tracking
• https://github.com/pytorch/pytorch/issues/149274#issue-2923122269 exploitissue-trackingExploitIssue Tracking
• https://github.com/pytorch/pytorch/blob/main/SECURITY.md#untrusted-models related