Cyber Resilience

CVE-2025-65887

Access Control in Oneflow 0.9.0

Public PoCAccess Control
Published
28 January 2026
Modified
05 July 2026
Patch / advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0030 23th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-65887 is a medium-severity Divide By Zero (CWE-369) vulnerability in Oneflow Oneflow. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-11 (Error Handling) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input tensor with zero.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

The division-by-zero flaw in flow.floor_divide() directly enables an application exhaustion or crash condition, matching T1499.004 (Endpoint Denial of Service: Application or System Exploitation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-71006Same product: Oneflow Oneflow
CVE-2025-71005Same product: Oneflow Oneflow
CVE-2025-71002Same product: Oneflow Oneflow
CVE-2025-65888Same product: Oneflow Oneflow
CVE-2025-71009Same product: Oneflow Oneflow
CVE-2025-71007Same product: Oneflow Oneflow
CVE-2025-71004Same product: Oneflow Oneflow
CVE-2025-71008Same product: Oneflow Oneflow
CVE-2025-70999Same product: Oneflow Oneflow
CVE-2025-65886Same product: Oneflow Oneflow

Affected Assets

oneflow
oneflow
0.9.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-11 Error Handling
  • SI-16 Memory Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Validates input tensors to reject zero values in floor_divide operations before arithmetic is performed.

prevent

Ensures division-by-zero exceptions are caught and handled gracefully without causing process termination or DoS.

prevent

Provides memory and execution protections that can contain the effects of unhandled arithmetic faults in the runtime.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.

PR.IR-01 mostly match
prevents

Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include code analysis, input validation, and testing that prevent divide-by-zero errors.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover divide-by-zero flaws via static analysis or testing.

PR.PS-02 partial match
prevents

Routine patching and replacement can remediate divide-by-zero bugs present in deployed software.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect divide-by-zero conditions before release.

prevents

Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.

prevents

Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.

prevents

Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.

mitigates

Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.

prevents

Secure development lifecycle includes input validation and error-handling practices that can prevent divide-by-zero faults.

References