CVE-2025-2953: PyTorch torch.mkldnn_max_pool2d denial of service
A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnnmaxpool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Other sources
PyTorch torch.mkldnnmaxpool2d denial of service
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/torchto a version that resolves this vulnerability.Fixed in 2.7.1-rc1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.0-9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.2-7
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2953?
CVE-2025-2953 is classified as a problematic vulnerability due to its potential to cause denial of service.
How do I fix CVE-2025-2953?
To mitigate CVE-2025-2953, upgrade to the latest version of PyTorch that addresses this vulnerability.
Which versions of PyTorch are affected by CVE-2025-2953?
CVE-2025-2953 affects PyTorch version 2.6.0+cu124 and possibly earlier versions.
What type of attack is associated with CVE-2025-2953?
The attack associated with CVE-2025-2953 leads to a denial of service and must be approached locally.
What function in PyTorch is impacted by CVE-2025-2953?
CVE-2025-2953 specifically impacts the function torch.mkldnn_max_pool2d in PyTorch.