CVE-2025-2149: PyTorch improper initialization in Quantized Sigmoid Module

CVE-2025-2149 · Severity: medium · CVSS 4 · Published 2025-03-10

A vulnerability exists in PyTorch, a popular machine learning library, specifically within its quantized Sigmoid module used for optimizing model performance. When loading a saved model state, the system fails to correctly restore certain internal mathematical parameters (scale and zero_point), leading to improper initialization. This could result in unexpected model behavior or integrity issues if an attacker can influence the model loading process on a local system.

Technologies: torch (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-2149 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-2149 being exploited in the wild.
How severe is CVE-2025-2149?
Medium severity, with a CVSS score of 4, published 10 March 2025.
Which products and versions are affected?
torch (PyPI) <= 2.6.0, ECOSYSTEM:introduced=0,last_affected=2.6.0, ECOSYSTEM:introduced=0,last_affected=2.6.0-cu124.
Is there a fix for CVE-2025-2149?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-2149 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2025-2149?
Check whether you run torch (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper initialization vulnerability (CWE-665) exists in the `nnq_Sigmoid` function of PyTorch's Quantized Sigmoid Module. The issue occurs because quantization parameters (`scale` and `zero_point`) are not correctly restored when a `state_dict` is loaded into a newly initialized module that has different initial parameters. An attacker with local access could potentially exploit this to cause integrity issues in machine learning models. The attack complexity is high as it requires specific local conditions to manipulate the model loading process. As of the advisory date, no official patch has been confirmed in the provided references, though the issue is tracked in the PyTorch repository.

Affected products

  • PyTorch PyTorch <= 2.6.0

Identifiers

  • CVE-2025-2149
  • GHSA-x3gm-94wq-g975
  • PYSEC-2025-190

Timeline

  • 2025-02-25: disclosed: Issue reported on PyTorch GitHub repository
  • 2025-03-10: advisory: GitHub Advisory and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.