Cyber Resilience

CVE-2025-55552

High

Published: 25 September 2025

Published
25 September 2025
Modified
03 October 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0015 35.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-55552 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Linuxfoundation Pytorch. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Runtime Data Manipulation (T1565.003); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Deep Learning Frameworks; in the Data-Related Vulnerabilities risk domain.

EU & UK References

Vulnerability details

pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.

CWE(s)
CWE-190CWE-682

AI Security AnalysisAI

AI Category
Deep Learning Frameworks
Risk Domain
Data-Related Vulnerabilities
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: pytorch

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1565.003 Runtime Data Manipulation Impact
Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.
attack.mitre.org →
Why these techniques?

The vulnerability causes silent incorrectness and unexpected behavior in PyTorch model compilation with Inductor, leading to incorrect outputs that facilitate runtime data manipulation.

Affected Assets

linuxfoundation
pytorch
≤ 2.8.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References