CVE-2025-4287 PyTorch nccl.py torch.cuda.nccl.reduce denial of service
A local attacker can cause a denial of service in PyTorch via the torch.cuda.nccl.reduce function, requiring a patch to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4287?
CVE-2025-4287 is a medium-severity denial of service vulnerability in PyTorch, published on 5 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.
Weakness: CWE-404
Which versions are affected by CVE-2025-4287?
How do I fix CVE-2025-4287?
No fix has been published for CVE-2025-4287 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-4287 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4287 exists.
Sources
Also known as DEBIAN-CVE-2025-4287, ECHO-3734-1b40-b231, GHSA-vw34-v45x-2c97, UBUNTU-CVE-2025-4287.