CVE-2025-3730: PyTorch LossCTC.cpp torch.nn.functional.ctc_loss denial of service
A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctcloss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue.
Other sources
A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctcloss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue. The security policy of the project warns to use unknown models which might establish malicious effects.
— MITRE
PyTorch LossCTC.cpp torch.nn.functional.ctcloss denial of service
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.0-8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.2-6 - Upgrade
Upgrade
PyTorchto a version that resolves this vulnerability.Patch 46fc5d8e360127361211cb237d5f9eef0223e567 - Compensating control
Approach the attack locally (limit exposure so the vulnerable functionality torch.nn.functional.ctc_loss in aten/src/ATen/native/LossCTC.cpp is not reachable remotely).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3730?
CVE-2025-3730 is classified as a problematic vulnerability with the potential for a denial of service.
How does CVE-2025-3730 affect PyTorch?
CVE-2025-3730 affects the function torch.nn.functional.ctc_loss in PyTorch and can lead to service disruptions.
Is CVE-2025-3730 exploitable remotely?
CVE-2025-3730 requires local access to exploit, meaning it cannot be exploited remotely.
When was CVE-2025-3730 discovered?
CVE-2025-3730 was reported in relation to PyTorch version 2.6.0.
How can I mitigate CVE-2025-3730?
To mitigate CVE-2025-3730, consider upgrading PyTorch to the latest version that addresses this vulnerability.