id: PYSEC-2025-190
published: "2025-03-10T13:15:36.290Z"
modified: "2026-02-24T18:52:49.347Z"
aliases:
- CVE-2025-2149
- GHSA-x3gm-94wq-g975
details: A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic.
  Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid
  Module. The manipulation of the argument scale/zero_point leads to improper initialization.
  The attack needs to be approached locally. The complexity of an attack is rather
  high. The exploitation is known to be difficult. The exploit has been disclosed
  to the public and may be used.
affected:
- package:
    name: torch
    ecosystem: PyPI
    purl: pkg:pypi/torch
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 2.6.0-cu124
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://vuldb.com/?id.299060
- type: REPORT
  url: https://github.com/pytorch/pytorch/issues/147818
- type: REPORT
  url: "https://github.com/pytorch/pytorch/issues/147818#issue-2877301660"
- type: REPORT
  url: https://vuldb.com/?ctiid.299060
- type: EVIDENCE
  url: https://vuldb.com/?submit.506563
- type: ADVISORY
  url: https://github.com/advisories/GHSA-x3gm-94wq-g975
severity:
- type: CVSS_V4
  score: 
    CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X