Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSummary
CVE-2025-65887 is a medium-severity Divide By Zero (CWE-369) vulnerability in Oneflow Oneflow. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-11 (Error Handling) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206483
Vulnerability Data
A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input tensor with zero.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The division-by-zero flaw in flow.floor_divide() directly enables an application exhaustion or crash condition, matching T1499.004 (Endpoint Denial of Service: Application or System Exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Validates input tensors to reject zero values in floor_divide operations before arithmetic is performed.
Ensures division-by-zero exceptions are caught and handled gracefully without causing process termination or DoS.
Provides memory and execution protections that can contain the effects of unhandled arithmetic faults in the runtime.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.
Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.
Secure SDLC practices directly include code analysis, input validation, and testing that prevent divide-by-zero errors.
Vulnerability identification processes can discover divide-by-zero flaws via static analysis or testing.
Routine patching and replacement can remediate divide-by-zero bugs present in deployed software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect divide-by-zero conditions before release.
Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.
Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.
Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.
Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.
Secure development lifecycle includes input validation and error-handling practices that can prevent divide-by-zero faults.