AVID-2026-R1695

Description

PyTorch LossCTC.cpp torch.nn.functional.ctc_loss denial of service (CVE-2025-3730)

Details

A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue. The security policy of the project warns to use unknown models which might establish malicious effects.

Reason for inclusion in AVID: The candidate describes a vulnerability in PyTorch (a core AI framework) affecting the ctc_loss function, which is used in AI model training/inference. It is a software vulnerability within a component (PyTorch) used to build/run general-purpose AI systems, representing a software supply-chain issue through a widely-used dependency. The CVE indicates local access is required, a DoS outcome, and patches exist, with multiple references. This aligns with AI-related, supply-chain-relevant security concerns in ML stacks. Despite low CVSS severity, the issue is real within AI software stacks and warrants curating for AVID.

References

Affected or Relevant Artifacts

Developer: n/a
Deployer: n/a
Artifact Details:

Type	Name
System	PyTorch

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score	3.3
Base Severity	🟢 Low

CWE

ID	Description
CWE-404	Denial of Service

Other information

Report Type: Advisory
Credits:
Date Reported: 2025-04-16
Version: 0.3.3
AVID Entry