Every CVE Search/ Get API key

CVE-2024-31580

PyTorch heap buffer overflow vulnerability

4.0 MediumFix available

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.22%Up 0.2 points since Apr 18, 2024
90%50%10%1%

What each source reports

CVE List Score used 4.0

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
CVE-2024-31580
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2024-1105 4.0

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
EUVD-2024-1105
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-5pcm-hx3q-hm94 8.7

PyTorch heap buffer overflow vulnerability

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
GHSA-5pcm-hx3q-hm94
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122
Updated
2026-11-02
NVD 4.0

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
CVE-2024-31580
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-122
Updated
2026-11-02
OSV 4.0

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
CVE-2024-31580
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2024-31580 4.0

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
DEBIAN-CVE-2024-31580
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-5pcm-hx3q-hm94 8.7

PyTorch heap buffer overflow vulnerability

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
GHSA-5pcm-hx3q-hm94
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVPYSEC-2024-328 4.0

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
PYSEC-2024-328
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2024-31580 4.0

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
UBUNTU-CVE-2024-31580
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-39930 No score

CVE-2024-31580 affecting package pytorch for versions less than 2.0.0-4

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
AZL-39930
Updated
2026-11-02
OSVBIT-pytorch-2024-31580 No score

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
BIT-pytorch-2024-31580
Updated
2026-11-02
OSVCLSA-2025-1762906448 No score

TuxCare security update for torch (2 CVEs)

TuxCare rebuilt torch to address 2 CVEs. Fixed in 1.13.1.post2+tuxcare.

Record
CLSA-2025-1762906448
Updated
2026-11-02
OSVPYSEC-2024-252 No score

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
PYSEC-2024-252
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
torch
PyPI
 before 2.2.0
2.2.0
pytorch
Azure Linux:2
 before 2.0.0-4
2.0.0-4
pytorch
Bitnami
 before 2.2.1
2.2.1
torch
TuxCare:PyPI
From an advisory covering 2 CVEs
 1.13.1 up to 1.13.1.post2+tuxcare, plus listed versions
1.13.1.post1+tuxcare
1.13.1.post2+tuxcare
pytorch
Debian:12
 All versions, plus listed versions
1.13.1+dfsg-41.13.1+dfsg-52.0.1+dfsg-12.0.1+dfsg-1~exp12.0.1+dfsg-2
Show 36 moreShow less
2.0.1+dfsg-42.0.1+dfsg-52.1.2+dfsg-12.1.2+dfsg-22.1.2+dfsg-42.12.0+dfsg2-12.12.0+dfsg2-1~exp12.12.0+dfsg2-1~exp22.12.0+dfsg2-22.12.0+dfsg2-32.12.0+dfsg2-42.12.1+dfsg-12.12.1+dfsg-22.14.1+dfsg-12.14.1+dfsg-1~exp12.4.1-12.4.1-32.4.1-42.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-32.5.1+dfsg-42.6.0+dfsg-12.6.0+dfsg-1~exp12.6.0+dfsg-22.6.0+dfsg-32.6.0+dfsg-42.6.0+dfsg-52.6.0+dfsg-72.6.0+dfsg-82.6.0+dfsg-92.6.0~rc9+dfsg-1~exp12.9.0+dfsg-1~exp12.9.0+dfsg-1~exp22.9.1+dfsg-1~exp12.9.1+dfsg-1~exp2
 None known
pytorch
Debian:13
 before 2.4.1-1
2.4.1-1
pytorch
Debian:14
 before 2.4.1-1
2.4.1-1
torch
PyPI
 before 2.2.0, plus listed versions
1.0.01.0.11.1.01.10.01.10.1
Show 24 moreShow less
1.10.21.11.01.12.01.12.11.13.01.13.11.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.7.11.8.01.8.11.9.01.9.12.0.02.0.12.1.02.1.12.1.2
2.2.0
torch
PyPI
 before 2.2.0, plus listed versions
1.0.01.0.11.1.01.10.01.10.1
Show 45 moreShow less
1.10.21.11.01.12.01.12.11.13.01.13.11.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.7.11.8.01.8.11.9.01.9.12.0.02.0.12.1.02.1.12.1.2ciflow/unstable/123bc2caa7fdf006894eff7af936babde69ab5a40f8-huydhn-debugciflow/periodic/3e98831ciflow/slow/da3aba1e46157c4df504b067477cdf2b3c96b194-sdymciflow/slow/0d5b74da0cab798fbfdb9caa53fad816999c8386-sdymciflow/slow/8751002215790a3a88750faa8f4366933e296693-sdymciflow/slow/a837609ciflow/slow/788ff06ciflow/slow/1faef89ciflow/slow/187eb7cciflow/slow/01c7106ciflow/slow/3920ec1ciflow/slow/0577043ciflow/slow/a206e8bciflow/slow/59a3759ciflow/slow/1732077ciflow/slow/9d85864ciflow/slow/0e81104ciflow/slow/3b7c6b2ciflow/slow/70ef0bbciflow/slow/af841f3
2.2.0
torch-npu
PyPI
 before 2.2.0, plus listed versions
2.1.02.1.0.post102.1.0.post122.1.0.post132.1.0.post17
Show 5 moreShow less
2.1.0.post32.1.0.post62.1.0.post82.1.0rc12.2.0rc1
2.2.0
Show 4 moreShow less
Affected packages
PackageAffectedFixed
pytorch
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.7.1-71.8.1-4
 None known
pytorch
Ubuntu:25.10
 All versions, plus listed versions
2.6.0+dfsg-5build12.6.0+dfsg-7
 None known
pytorch
Ubuntu:26.10
 All versions, plus listed versions
2.9.1+dfsg-1~exp1ubuntu22.12.1+dfsg-1
 None known
pytorch
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.6.0+dfsg-72.6.0+dfsg-92.9.1+dfsg-1~exp1ubuntu2
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-31580 is a medium vulnerability (CVSS 4.0) in Linuxfoundation Pytorch, published April 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in torch 2.2.0.

References

Show 5 moreShow less
This page doesn't list everything

Left out here: 36 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open