GHSA-c678-jfcj-6jmf

Source

https://github.com/advisories/GHSA-c678-jfcj-6jmf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-c678-jfcj-6jmf/GHSA-c678-jfcj-6jmf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c678-jfcj-6jmf

Aliases

Published

2025-03-10T12:30:55Z

Modified

2026-06-09T21:26:06.844649427Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument

Details

A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler.callendcallbacksonjitfut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.

Database specific

{
    "nvd_published_at": "2025-03-10T12:15:12Z",
    "github_reviewed_at": "2026-06-09T21:06:54Z",
    "github_reviewed": true,
    "severity": "LOW",
    "cwe_ids": [
        "CWE-119"
    ]
}

References

Affected packages

PyPI / torch

Package

Name: torch; View open source insights on deps.dev
Purl: pkg:pypi/torch

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.6.0

Affected versions

1.*

1.0.0

1.0.1

1.1.0

1.2.0

1.3.0

1.3.1

1.4.0

1.5.0

1.5.1

1.6.0

1.7.0

1.7.1

1.8.0

1.8.1

1.9.0

1.9.1

1.10.0

1.10.1

1.10.2

1.11.0

1.12.0

1.12.1

1.13.0

1.13.1

2.*

2.0.0

2.0.1

2.1.0

2.1.1

2.1.2

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

2.4.0

2.4.1

2.5.0

2.5.1

2.6.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-c678-jfcj-6jmf/GHSA-c678-jfcj-6jmf.json"