CVE-2025-3136

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_delete of the file c10/cuda/CUDACachingAllocator.cpp. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
n/a	PyTorch	2.6.0

References

https://github.com/pytorch/pytorch/issues/149821Exploit, Issue Tracking, Vendor Advisory
https://github.com/pytorch/pytorch/issues/149821#issue-2940838975Exploit, Issue Tracking, Vendor Advisory
https://github.com/pytorch/pytorch/issues/149821#issuecomment-2765311086Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.303041Permissions Required, VDB Entry
https://vuldb.com/?id.303041Third Party Advisory, VDB Entry
https://vuldb.com/?submit.525252Exploit, Third Party Advisory, VDB Entry
https://github.com/ARPANET-cybersecurity/vuldb/issues/2Not Applicable

Timeline

Published: Apr 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-313607.5Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.CVE-2025-313618.7A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to CVE-2025-313623.7Use of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside robot files may be obtained if the encryption CVE-2025-313636.5Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream wh CVE-2025-313657.1An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2 CVE-2025-313666.1An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3,CVE-2025-31379.8A vulnerability, which was classified as critical, was found in PHPGurukul Online Security Guards Hiring System 1.0. Affected is an unknown CVE-2025-313757.1Cross-Site Request Forgery (CSRF) vulnerability in bhoogterp Scheduled scheduled allows Stored XSS.This issue affects Scheduled: from n/a th CVE-2025-313764.3Missing Authorization vulnerability in Mayeenul Islam NanoSupport nanosupport allows Exploiting Incorrectly Configured Access Control Securi CVE-2025-313777.5Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels woocommerce-to-google-merchant-center allow CVE-2025-313787.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danbwb Oppso Unit Converter oppso-unit CVE-2025-313797.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in programphases Insert HTML Here insert-