CVE-2025-4287: PyTorch nccl.py torch.cuda.nccl.reduce denial of service
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pytorchto a version that resolves this vulnerability.Patch 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5 - Compensating control
Since the issue can be exploited on the local host to cause denial of service, restrict local access to the system running PyTorch (e.g., limit who can run or trigger code paths that use torch.cuda.nccl.reduce).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4287?
CVE-2025-4287 is rated as problematic.
How do I fix CVE-2025-4287?
To fix CVE-2025-4287, update PyTorch to a version that contains the patch for this vulnerability.
What type of attack does CVE-2025-4287 enable?
CVE-2025-4287 enables a denial of service attack on the local host.
Which function is affected by CVE-2025-4287?
The function affected by CVE-2025-4287 is torch.cuda.nccl.reduce.
What versions of PyTorch are affected by CVE-2025-4287?
CVE-2025-4287 affects PyTorch version 2.6.0 and later with CUDA 12.4.