VYPR
← All advisories
High severityNVD Advisory· Published Apr 17, 2024· Updated Mar 28, 2025

CVE-2024-31580

CVE-2024-31580

Description

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap buffer overflow in PyTorch before v2.2.0 in vararg_functions.cpp allows denial of service via crafted input.

Overview

PyTorch versions before v2.2.0 contain a heap buffer overflow vulnerability in the /runtime/vararg_functions.cpp component [2]. The bug is triggered by a crafted input that causes out-of-bounds memory access.

Exploitation

An attacker can exploit this by providing a specially crafted input to a vulnerable PyTorch installation. No authentication is required if the attacker can supply input to the affected function, potentially through a network service or data processing pipeline [2].

Impact

Successful exploitation leads to a denial of service (DoS) due to heap memory corruption. The overflow may also cause undefined behavior, but the primary reported impact is service disruption [2][4].

Mitigation

The vulnerability has been fixed in PyTorch v2.2.0. Users should upgrade to this version or later. A specific patch commit is available in the PyTorch repository [4].

References
  1. NVD - CVE-2024-31580
  2. CVE-2024-31580

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
torchPyPI
< 2.2.02.2.0

Affected products

3

Patches

1
b5c3a17c2c20

[fuzzing result][fuzz_torch_jit_lite_interpreter] read-heap-buffer-overflow-far-from-bounds (size 4) in c10::IValue::IValue() (#110441)

https://github.com/pytorch/pytorchOctavian GuzuOct 3, 2023via ghsa
commit
1 file changed · +3 −0
  • torch/csrc/jit/runtime/vararg_functions.cpp+3 −0 modified
    @@ -267,6 +267,9 @@ void listUnpack(Stack& stack, size_t num_outputs) {
 }
 
 void tupleConstruct(Stack& stack, size_t num_inputs) {
+  if (num_inputs > stack.size()) {
+    TORCH_CHECK(false, "Invalid number of inputs: ", num_inputs);
+  }
   switch (num_inputs) {
     case 0:
       stack.emplace_back(c10::ivalue::Tuple::create());

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.