MediumVulnerability
CVE-2025-3001: PyTorch memory corruption in torch.lstm_cell reachable locally
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-3001
- Published
- Record updated
- Affected
- torch < 2.10.0
- Fixed in
- 2.10.0
- released January 21, 2026, 296 days after disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
CVE-2025-3001 is a vulnerability classified as critical in PyTorch 2.6.0, affecting the function torch.lstm_cell. The manipulation leads to memory corruption, and an attacker must approach locally. The exploit has been publicly disclosed and may be used.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- torchPyPINo LLM dependency detected · 200 tracked dependents
Related items
- HighCVE-2026-77177: Open GenAI Stack code execution via prompt injection with Jinja2 templatesSame vendor · NVD/CVE Database
- MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
- MediumChina-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI CompaniesSame vendor · CISA Cybersecurity Advisories
- MediumCVE-2026-4538: PyTorch 2.10.0 deserialization flaw in pt2 Loading Handler via local accessSame vendor · NVD/CVE Database
- MediumCVE-2025-55554: pytorch integer overflow in torch.nan_to_num long conversionSame vendor · NVD/CVE Database