CVE-2025-2149
low-risk
Published 2025-03-10
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initialization. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Do I need to act?
-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.5/10
Low
LOCAL
/ HIGH complexity
Affected Products (1)
Affected Vendors
References (7)
Issue Tracking
https://github.com/pytorch/pytorch/issues/147818
Permissions Required
https://vuldb.com/?ctiid.299060
Third Party Advisory
https://vuldb.com/?id.299060
Exploit
https://vuldb.com/?submit.506563
Issue Tracking
https://github.com/pytorch/pytorch/issues/147818
11
/ 100
low-risk
Severity
6/34 · Minimal
Exploitability
0/34 · Minimal
Exposure
5/34 · Minimal