CVE-2025-46148

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

5.3 MediumFix available

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.40%Up 0.4 points since Sep 26, 2025

What each source reports

CVE List Score used 5.3

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Record: CVE-2025-46148
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

EUVDEUVD-2025-31112 5.3

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Record: EUVD-2025-31112
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m7x9-2m87-mqhf 5.3

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Record: GHSA-m7x9-2m87-mqhf
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

NVD 5.3

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Record: CVE-2025-46148
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-06

OSV 5.3

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Record: CVE-2025-46148
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-07

OSVDEBIAN-CVE-2025-46148 5.3

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Record: DEBIAN-CVE-2025-46148
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-06

OSVPYSEC-2025-198 5.3

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Record: PYSEC-2025-198
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-46148 5.3

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Record: UBUNTU-CVE-2025-46148
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVBIT-pytorch-2025-46148 No score

In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.

Record: BIT-pytorch-2025-46148
Updated: 2026-11-02

Affected products

linuxfoundation pytorch

Affected packages

Affected packages
Package	Affected	Fixed
`pytorch` Bitnami	before 2.7.0	2.7.0
`pytorch` Debian:12	All versions, plus listed versions 1.13.1+dfsg-41.13.1+dfsg-52.0.1+dfsg-12.0.1+dfsg-1~exp12.0.1+dfsg-2 Show 36 moreShow less 2.0.1+dfsg-42.0.1+dfsg-52.1.2+dfsg-12.1.2+dfsg-22.1.2+dfsg-42.12.0+dfsg2-12.12.0+dfsg2-1~exp12.12.0+dfsg2-1~exp22.12.0+dfsg2-22.12.0+dfsg2-32.12.0+dfsg2-42.12.1+dfsg-12.12.1+dfsg-22.14.1+dfsg-12.14.1+dfsg-1~exp12.4.1-12.4.1-32.4.1-42.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-32.5.1+dfsg-42.6.0+dfsg-12.6.0+dfsg-1~exp12.6.0+dfsg-22.6.0+dfsg-32.6.0+dfsg-42.6.0+dfsg-52.6.0+dfsg-72.6.0+dfsg-82.6.0+dfsg-92.6.0~rc9+dfsg-1~exp12.9.0+dfsg-1~exp12.9.0+dfsg-1~exp22.9.1+dfsg-1~exp12.9.1+dfsg-1~exp2	None known
`pytorch` Debian:13	All versions, plus listed versions 2.12.0+dfsg2-12.12.0+dfsg2-1~exp12.12.0+dfsg2-1~exp22.12.0+dfsg2-22.12.0+dfsg2-3 Show 12 moreShow less 2.12.0+dfsg2-42.12.1+dfsg-12.12.1+dfsg-22.14.1+dfsg-12.14.1+dfsg-1~exp12.6.0+dfsg-72.6.0+dfsg-82.6.0+dfsg-92.9.0+dfsg-1~exp12.9.0+dfsg-1~exp22.9.1+dfsg-1~exp12.9.1+dfsg-1~exp2	None known
`pytorch` Debian:14	before 2.12.0+dfsg2-1, plus listed versions 2.12.0+dfsg2-1~exp12.12.0+dfsg2-1~exp22.6.0+dfsg-72.6.0+dfsg-82.6.0+dfsg-9 Show 4 moreShow less 2.9.0+dfsg-1~exp12.9.0+dfsg-1~exp22.9.1+dfsg-1~exp12.9.1+dfsg-1~exp2	2.12.0+dfsg2-1
`torch` PyPI	before 2.7.0, plus listed versions 1.0.01.0.11.1.01.10.01.10.1 Show 34 moreShow less 1.10.21.11.01.12.01.12.11.13.01.13.11.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.7.11.8.01.8.11.9.01.9.12.0.02.0.12.1.02.1.12.1.22.2.02.2.12.2.22.3.02.3.12.4.02.4.12.5.02.5.12.6.0	2.7.0
`pytorch` Ubuntu:22.04:LTS	All versions, plus listed versions 1.7.1-71.8.1-4	None known
`pytorch` Ubuntu:25.10	All versions, plus listed versions 2.6.0+dfsg-5build12.6.0+dfsg-7	None known
`pytorch` Ubuntu:26.10	All versions, plus listed versions 2.9.1+dfsg-1~exp1ubuntu22.12.1+dfsg-1	None known
`pytorch` Ubuntu:26.04:LTS	All versions, plus listed versions 2.6.0+dfsg-72.6.0+dfsg-92.9.1+dfsg-1~exp1ubuntu2	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 6, 2026	facts	NVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-46148 is a medium vulnerability (CVSS 5.3) in Linuxfoundation Pytorch, published September 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in pytorch 2.7.0.

References

Show 4 moreShow less