CVE-2025-46150
📋 TL;DR
This CVE describes a vulnerability in PyTorch's torch.compile feature where FractionalMaxPool2d produces inconsistent results. This could lead to incorrect model outputs or training failures in machine learning applications. Users of PyTorch with torch.compile enabled are affected.
💻 Affected Systems
- PyTorch
📦 What is this software?
Pytorch by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Machine learning models produce incorrect predictions or fail during training, potentially leading to business logic errors, financial miscalculations, or safety-critical failures in deployed AI systems.
Likely Case
Inconsistent model behavior during training or inference, causing degraded performance, failed training runs, or unreliable predictions in production ML pipelines.
If Mitigated
With proper input validation and output verification, the impact is limited to potential performance degradation or training failures rather than silent incorrect predictions.
🎯 Exploit Status
Exploitation requires understanding of PyTorch's compilation pipeline and ability to trigger specific tensor operations. No known active exploitation in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PyTorch 2.7.0 and later
Vendor Advisory: https://github.com/pytorch/pytorch/issues/141538
Restart Required: No
Instructions:
1. Update PyTorch using pip: 'pip install torch==2.7.0' or 'pip install --upgrade torch' 2. Verify installation with 'python -c "import torch; print(torch.__version__)"' 3. Ensure version is 2.7.0 or higher
🔧 Temporary Workarounds
Disable torch.compile for affected operations
allAvoid using torch.compile with FractionalMaxPool2d operations until patched
# Use standard PyTorch execution instead of torch.compile
# Example: Remove @torch.compile decorator or disable compilation
Use alternative pooling operations
allReplace FractionalMaxPool2d with other pooling layers like MaxPool2d
# Replace: nn.FractionalMaxPool2d(...)
# With: nn.MaxPool2d(...) or other appropriate pooling layers
🧯 If You Can't Patch
- Implement rigorous output validation for models using FractionalMaxPool2d with torch.compile
- Add monitoring and alerting for inconsistent model behavior or prediction drift
🔍 How to Verify
Check if Vulnerable:
Check PyTorch version and test FractionalMaxPool2d with torch.compile for inconsistent outputsCheck Version:
python -c "import torch; print(torch.__version__)"Verify Fix Applied:
After updating to PyTorch 2.7.0+, verify that FractionalMaxPool2d produces consistent results with torch.compile enabled📡 Detection & Monitoring
Log Indicators:
- Model training failures
- Prediction inconsistencies
- Numerical instability warnings in ML logs
Network Indicators:
- N/A - This is a local computation issue
SIEM Query:
Search for error messages containing 'FractionalMaxPool2d', 'torch.compile', or PyTorch version strings below 2.7.0 in application logs