{"id":"CVE-2024-31580","aliases":["GHSA-5pcm-hx3q-hm94","BIT-pytorch-2024-31580","PYSEC-2024-252","PYSEC-2024-328"],"title":"PyTorch heap buffer overflow vulnerability","summary":"PyTorch heap buffer overflow vulnerability","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"torch","product":"torch","ecosystem":"pip","affected":["torch < 2.2.0"],"patched":["torch 2.2.0"],"published":"2024-04-17","updated":"2026-07-27","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5pcm-hx3q-hm94","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31580"},{"url":"https://github.com/pytorch/pytorch/commit/b5c3a17c2c207ebefcb85043f0cf94be9b2fef81"},{"url":"https://gist.github.com/1047524396/038c78f2f007345e6f497698ace2aa3d"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2024-252.yaml"},{"url":"https://github.com/pytorch/pytorch"},{"url":"https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-6649934"}],"tags":["osv","pip"],"epss":0.00225,"epssPercentile":0.13484,"ingestedAt":"2026-07-27T19:08:53.977Z","slug":"CVE-2024-31580","body":"## Overview\n\nPyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.\n\n## Affected packages\n\n- `torch < 2.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `torch 2.2.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}