AI Threat Alert

PyTorch Vulnerabilities

pip ML Libraries

AI Threat Alert tracks 45 known vulnerabilities in PyTorch, 9 rated critical — an AI/ML ml libraries in the pip ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources

85

Risk Score

45

Total CVEs

9

Critical

pip

Ecosystem

Jun 19, 2026

Last CVE

11%

Patch Rate

216d

Avg Time to Patch

101,067 stars 28,143 forks 18,265 issues 22,748 dependents Last push Jun 28, 2026

OpenSSF Scorecard 6.4/10

Known Vulnerabilities (45 total, page 1 of 2)

Severity CVE ID Summary CVSS Published

HIGH CVE-2026-54499 Stanza: pickle fallback bypass enables model RCE 7.5 Jun 19, 2026 UNKNOWN CVE-2026-53875 picklescan: scanner bypass enables PyTorch RCE -- Jun 17, 2026 CRITICAL CVE-2026-31239 mamba: RCE via unsafe torch.load() on model load 9.8 May 12, 2026 CRITICAL CVE-2026-31238 Ludwig: RCE via unsafe pickle deserialization in model serve 9.8 May 12, 2026 HIGH CVE-2026-31224 snorkel: RCE via unsafe model deserialization 8.8 May 12, 2026 HIGH CVE-2026-31222 snorkel: RCE via insecure model checkpoint loading 8.8 May 12, 2026 HIGH CVE-2026-31253 flash-attention: RCE via unsafe checkpoint deserialization 7.3 May 11, 2026 HIGH CVE-2026-24747 pytorch: Code Injection enables RCE 8.8 Jan 27, 2026 LOW CVE-2025-63396 pytorch: security flaw enables exploitation 3.3 Nov 12, 2025 HIGH CVE-2025-55560 PyTorch: DoS via sparse/dense tensor Inductor compile 7.5 Sep 25, 2025 HIGH CVE-2025-55558 PyTorch: Inductor compiler buffer overflow causes DoS 7.5 Sep 25, 2025 HIGH CVE-2025-55557 PyTorch: DoS via cummin+Inductor NameError in 2.7.0 7.5 Sep 25, 2025 MEDIUM CVE-2025-55554 PyTorch: integer overflow in nan_to_num causes DoS 5.3 Sep 25, 2025 HIGH CVE-2025-55553 PyTorch 2.7.0: DoS via proxy_tensor.py syntax error 7.5 Sep 25, 2025 HIGH CVE-2025-55552 PyTorch: integer overflow in rot90+randn_like causes DoS 7.5 Sep 25, 2025 HIGH CVE-2025-55551 PyTorch: DoS in linalg.lu via malformed slice op 7.5 Sep 25, 2025 MEDIUM CVE-2025-46153 PyTorch: Dropout inconsistency enables membership inference 5.3 Sep 25, 2025 MEDIUM CVE-2025-46152 PyTorch: OOB write causes incorrect bitwise shift results 5.3 Sep 25, 2025 MEDIUM CVE-2025-46150 PyTorch: torch.compile silent output inconsistency 5.3 Sep 25, 2025 MEDIUM CVE-2025-46149 PyTorch: reachable assertion in nn.Fold with inductor 5.3 Sep 25, 2025 MEDIUM CVE-2025-46148 PyTorch: PairwiseDistance silent miscalculation, integrity risk 5.3 Sep 25, 2025 CRITICAL CVE-2025-32434 PyTorch: RCE bypasses weights_only=True safe-load guard 9.8 Apr 18, 2025 MEDIUM CVE-2025-3730 PyTorch: DoS via ctc_loss resource mishandling 5.5 Apr 16, 2025 LOW CVE-2025-3136 PyTorch: memory corruption in CUDA caching allocator 3.3 Apr 3, 2025 MEDIUM CVE-2025-3121 PyTorch: memory corruption in JIT flatbuffer loader 5.5 Apr 2, 2025

Showing 1–25 of 45

Frequently asked questions

What is PyTorch?

PyTorch is an AI/ML ml libraries tracked by AI Threat Alert for security vulnerabilities in the pip ecosystem.

How many known vulnerabilities does PyTorch have?

PyTorch has 45 known CVEs, 9 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is PyTorch distributed in?

PyTorch is distributed via the pip ecosystem and categorized as ml libraries.

Where does the PyTorch vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of PyTorch?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor PyTorch in your stack

Get instant alerts when new vulnerabilities affect PyTorch. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring