CVE-2025-55557 Overview
CVE-2025-55557 affects PyTorch v2.7.0 and triggers a Name Error when the Inductor compiler processes a model containing the torch.cummin operation. The error halts model compilation and results in a Denial of Service (DoS) condition for applications that depend on Inductor-compiled PyTorch models. The flaw is tracked under [CWE-248: Uncaught Exception] and impacts availability without exposing data or enabling code execution. PyTorch maintainers acknowledged the issue in GitHub issue #151738 and merged a fix via pull request #151931.
Critical Impact
Applications compiling PyTorch models that include torch.cummin through Inductor crash at runtime, disrupting machine learning inference and training workloads.
Affected Products
- PyTorch v2.7.0 (linuxfoundation:pytorch)
- Python-based ML pipelines using the Inductor backend
- Applications invoking torch.compile() on models containing torch.cummin
Discovery Timeline
- 2025-09-25 - CVE-2025-55557 published to NVD
- 2025-10-03 - Last updated in NVD database
Technical Details for CVE-2025-55557
Vulnerability Analysis
The vulnerability resides in the PyTorch Inductor compiler path when it lowers the torch.cummin operator. Inductor fails to resolve a symbol required during code generation, raising a Python NameError that propagates as an uncaught exception. The exception aborts compilation and prevents the model from executing.
This class of flaw is categorized as [CWE-248: Uncaught Exception], a defect that converts a recoverable compile-time mistake into a process-level failure. The attack vector is network-reachable in scenarios where models or model definitions are supplied by untrusted users, such as model-serving platforms, inference APIs, or shared ML notebooks.
Exploitation does not require authentication or user interaction. The impact is limited to availability — confidentiality and integrity remain unaffected.
Root Cause
The root cause is a missing or misreferenced identifier in the Inductor lowering logic for the cumulative minimum operation. When the compiler attempts to emit code for torch.cummin, the referenced name is undefined in the generated scope, producing a NameError at compile time. The fix in pull request #151931 corrects the symbol reference inside Inductor.
Attack Vector
An attacker submits a model or computational graph that includes torch.cummin to a service that compiles models via Inductor. When the target invokes torch.compile() on the supplied model, Inductor raises the uncaught NameError and the worker process terminates or hangs. Repeated submissions can keep an inference endpoint or training job in a perpetually failed state.
A proof of concept is published in the GitHub Gist PoC Repository and discussed in the GitHub Issue Discussion. No public exploit kit or active in-the-wild exploitation has been reported.
Detection Methods for CVE-2025-55557
Indicators of Compromise
- Python tracebacks containing NameError raised from torch._inductor modules during torch.compile() invocation
- Repeated crashes of ML inference workers immediately after receiving new model definitions
- Log entries referencing cummin lowering failures in PyTorch worker processes
Detection Strategies
- Inventory all PyTorch installations and flag deployments running version 2.7.0 with Inductor enabled
- Monitor model-serving APIs for elevated rates of compilation failures or worker restarts
- Inspect uploaded or user-supplied model graphs for the torch.cummin operator when received from untrusted sources
Monitoring Recommendations
- Forward Python and container logs from ML workloads to a centralized log platform and alert on NameError traces from Inductor
- Track availability metrics for inference endpoints and correlate spikes in 5xx errors with PyTorch compilation events
- Apply behavioral monitoring on ML serving hosts to detect abnormal process termination patterns
How to Mitigate CVE-2025-55557
Immediate Actions Required
- Identify production and development systems running PyTorch v2.7.0 and inventory their use of torch.compile() with the Inductor backend
- Restrict model submission endpoints to authenticated, trusted users until a patched build is deployed
- Apply the upstream fix from PyTorch pull request #151931 or upgrade to a release that includes the patch
Patch Information
The maintainers merged the corrective change in PyTorch PR #151931. Operators should rebuild PyTorch from a commit that includes this pull request or upgrade to a subsequent stable release. Review the GitHub Issue Discussion for the maintainers' analysis and confirmation of the fix.
Workarounds
- Disable Inductor and fall back to the eager execution path when torch.cummin appears in a model
- Replace torch.cummin with an equivalent composition of supported operators in critical models until the patch is applied
- Validate user-supplied model graphs and reject those containing operators known to trigger Inductor failures
# Configuration example: disable Inductor backend as a temporary workaround
export TORCH_COMPILE_DISABLE=1
# Or programmatically bypass torch.compile in affected code paths
python -c "import torch; print(torch.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
