CVE-2025-55558

HighCVSS 7.5/10Last modified Nov 5, 2026

Description

A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efcThird Party Advisory
https://github.com/pytorch/pytorch/issues/151523Issue Tracking
https://github.com/pytorch/pytorch/pull/151887Issue Tracking, Patch

Timeline

Published: Sep 25, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-555597.5An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D.CVE-2025-55568.8A vulnerability, which was classified as critical, was found in PHPGurukul Teacher Subject Allocation Management System 1.0. This affects an CVE-2025-555607.5An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.CVE-2025-555647.5Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.CVE-2025-55578.8A vulnerability has been found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This vulnerability CVE-2025-555738.8QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).CVE-2025-555746.1Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code CVE-2025-555759.8SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=CVE-2025-555795.4SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. The vulnerability is f CVE-2025-55588.8A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This issue affects some CVE-2025-555805.4SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can i CVE-2025-555817.3D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script.