CVE-2025-2998: 
Homebrew vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-2998) was discovered in PyTorch version 2.6.0, specifically affecting the function torch.nn.utils.rnn.pad_packed_sequence. The vulnerability was disclosed on March 31, 2025, and has been classified as critical. This security issue requires local access to exploit and has been publicly disclosed (NVD Database, MITRE CVE).

The vulnerability is classified as a memory corruption issue (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). It has received a CVSS v4.0 score of 4.8 (MEDIUM) with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N, and a CVSS v3.1 score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (NVD Database).

The vulnerability can lead to memory corruption when processing empty tensors in the affected function. This can result in segmentation faults and potential system crashes, as demonstrated by proof-of-concept code that triggers the vulnerability (GitHub Issue).

The vulnerability requires local access to exploit, and proof-of-concept code has been publicly disclosed. The exploit has been confirmed to work with empty tensor inputs, making it relatively straightforward to trigger the vulnerability in affected systems (GitHub Issue).