CVE-2025-55552: PyTorch Unexpected Behavior Vulnerability

CVE-2025-55552 Overview

CVE-2025-55552 affects PyTorch v2.8.0, an open-source machine learning framework maintained by the Linux Foundation. The vulnerability manifests when the torch.rot90 and torch.randn_like components are used together, producing unexpected behavior tied to an integer overflow condition [CWE-190] and an incorrect calculation [CWE-682]. Successful exploitation leads to a denial-of-service condition impacting tensor operations. The flaw is network-reachable when PyTorch is exposed through model-serving endpoints or shared inference services. No authentication or user interaction is required to trigger the faulty code path.

Critical Impact
An unauthenticated attacker can trigger a high-availability impact in PyTorch v2.8.0 by invoking torch.rot90 together with torch.randn_like on crafted tensor inputs.

Affected Products

PyTorch v2.8.0 (Python distribution)
Linux Foundation linuxfoundation:pytorch
Applications and services embedding the affected PyTorch release

Discovery Timeline

2025-09-25 - CVE-2025-55552 published to NVD
2025-10-03 - Last updated in NVD database

Technical Details for CVE-2025-55552

Vulnerability Analysis

The defect arises in PyTorch v2.8.0 when torch.rot90 interacts with torch.randn_like. The combination produces an integer overflow [CWE-190] during tensor shape or stride calculation, classified as an incorrect calculation [CWE-682]. The overflow corrupts internal size accounting, leading to runtime failure or process termination on the worker handling the operation.

The vulnerability targets availability only. Confidentiality and integrity of tensor data remain unaffected. However, in multi-tenant ML inference platforms, a single crash can disrupt batched workloads and downstream pipelines.

Public technical context is available in the GitHub PyTorch Issue Discussion and a reproduction in the GitHub Gist Resource.

Root Cause

The root cause is improper handling of tensor dimensions when torch.rot90 rotates a tensor whose shape is then propagated into torch.randn_like. Size computations overflow native integer types, producing nonsensical allocation requests or shape metadata. The downstream allocator or kernel receives invalid parameters and aborts execution.

Attack Vector

An attacker submits crafted tensor inputs to a service that internally chains torch.rot90 with torch.randn_like. Any network-accessible endpoint that forwards user-controlled tensor shapes to these APIs is reachable. Exploitation requires no credentials. The result is a denial of service against the PyTorch process handling the request.

No verified exploit code is published. Technical reproduction details are documented in the linked PyTorch issue tracker.

Detection Methods for CVE-2025-55552

Indicators of Compromise

Unexpected crashes or RuntimeError exceptions in PyTorch worker processes invoking torch.rot90 followed by torch.randn_like
Repeated abnormal terminations of inference services correlated with specific tensor input shapes
Stack traces referencing tensor shape or stride computations within PyTorch v2.8.0

Detection Strategies

Audit application code and dependency graphs for chained calls to torch.rot90 and torch.randn_like on untrusted inputs
Inventory deployed PyTorch versions using software bill of materials (SBOM) tooling and flag instances of v2.8.0
Implement input validation that bounds tensor dimensions before they reach affected APIs

Monitoring Recommendations

Monitor inference worker uptime, restart counts, and out-of-memory events
Log all tensor shape parameters at API boundaries to support post-incident reconstruction
Alert on repeated SIGABRT or allocator failures in ML serving containers

How to Mitigate CVE-2025-55552

Immediate Actions Required

Identify all systems running PyTorch v2.8.0 and prioritize remediation for network-exposed inference services
Restrict untrusted input that controls tensor shapes passed to torch.rot90 or torch.randn_like
Apply rate limiting and input size caps on model inference endpoints

Patch Information

No vendor advisory URL is listed in the NVD record at publication. Track the GitHub PyTorch Issue Discussion for upstream fix status and upgrade to a patched release once available.

Workarounds

Avoid chaining torch.rot90 directly into torch.randn_like on attacker-controlled tensors; materialize an intermediate tensor with validated dimensions
Wrap the affected call path in defensive try/except handlers that reject oversized shapes before invocation
Isolate PyTorch inference workers in containers with automatic restart policies to limit denial-of-service impact

bash

# Configuration example: enforce tensor dimension limits at the API gateway
# Reject requests where any tensor dimension exceeds a safe upper bound
MAX_TENSOR_DIM=8192
if [ "$REQUEST_TENSOR_DIM" -gt "$MAX_TENSOR_DIM" ]; then
  echo "Rejecting request: tensor dimension exceeds safe limit"
  exit 1
fi