CVE-2025-46150

Executive Summary

CVE-2025-46150 affects PyTorch versions prior to 2.7.0, specifically when using the torch.compile feature. The vulnerability lies in the FractionalMaxPool2d operation, which produces inconsistent results under compilation. This inconsistency can lead to unpredictable model behavior, potentially causing incorrect outputs in downstream applications that rely on deterministic pooling operations. While no active exploitation has been observed (EPSS 0.0%), the issue undermines the reliability of compiled PyTorch models, posing a risk to production systems that depend on consistent numerical results.

Supply Chain & Package Security

This vulnerability is specific to the PyTorch Python package ecosystem. Organizations using PyTorch in their machine learning pipelines should verify their installed version and update to 2.7.0 or later. The issue is not related to any third-party dependencies but is inherent to the PyTorch compilation engine (torch.compile). Package managers (pip, conda) should be used to enforce version constraints.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unscored) Vector: UNKNOWN

The CVSS score is currently unassigned, likely due to the lack of a clear security impact (e.g., no remote code execution, no data breach). However, the vulnerability is classified as a logic/integrity issue that can cause silent data corruption in compiled models. The threat level is Low for direct exploitation but Medium for operational reliability.

Deep Dive & Mechanics

The FractionalMaxPool2d operation is a variant of max pooling that uses random sampling to produce output regions of varying sizes. When torch.compile is enabled, PyTorch’s JIT compiler attempts to optimize the operation graph. Due to a flaw in the compilation pass, the random sampling logic is not correctly preserved, leading to inconsistent pooling results between eager mode and compiled mode.

Root Cause: The torch.compile engine fails to correctly handle the random state or the dynamic region generation within FractionalMaxPool2d. This results in either:

• Different output values for the same input across runs.
• Output shapes that deviate from the expected specification.

Impact: Models relying on FractionalMaxPool2d for feature extraction (e.g., in computer vision tasks) may produce non-deterministic or incorrect predictions when compiled. This can affect model validation, reproducibility, and production inference.

Vulnerable vs. Patched Code

Vulnerable (PyTorch < 2.7.0):

import torch
import torch.nn as nn

model = nn.Sequential(
    nn.FractionalMaxPool2d(kernel_size=2, output_ratio=(0.5, 0.5))
)
compiled_model = torch.compile(model)
input_tensor = torch.randn(1, 3, 8, 8)
output = compiled_model(input_tensor)  # Inconsistent results

Patched (PyTorch 2.7.0+):

import torch
import torch.nn as nn

model = nn.Sequential(
    nn.FractionalMaxPool2d(kernel_size=2, output_ratio=(0.5, 0.5))
)
compiled_model = torch.compile(model)
input_tensor = torch.randn(1, 3, 8, 8)
output = compiled_model(input_tensor)  # Consistent results

The patch ensures that the random sampling logic is correctly handled during compilation, guaranteeing deterministic behavior.

Exploitation & Lab Setup

Red Team

No public exploit code exists. However, an attacker could weaponize this vulnerability to cause denial of service or model poisoning in environments where torch.compile is used. For example:

1. Deploy a malicious PyTorch model that uses FractionalMaxPool2d and is compiled.
2. The model produces inconsistent outputs, leading to incorrect decisions in downstream systems (e.g., autonomous driving, medical imaging).
3. The attacker could also trigger a crash by exploiting shape mismatches.

Lab Setup:

pip install torch==2.6.0
python -c "
import torch
import torch.nn as nn
model = nn.FractionalMaxPool2d(kernel_size=2, output_ratio=(0.5, 0.5))
compiled = torch.compile(model)
x = torch.randn(1, 1, 10, 10)
print(compiled(x).shape)  # May differ from eager mode
"

Blue Team

To detect exploitation attempts:

1. Monitor for unusual model loading patterns, especially torch.compile usage with FractionalMaxPool2d.
2. Log and compare model outputs between eager and compiled modes during validation.
3. Use runtime anomaly detection to flag non-deterministic behavior in production inference.

Detection Script:

import torch
import torch.nn as nn

def check_fractional_max_pool_consistency():
    model = nn.FractionalMaxPool2d(kernel_size=2, output_ratio=(0.5, 0.5))
    compiled = torch.compile(model)
    x = torch.randn(1, 1, 10, 10)
    eager_out = model(x)
    compiled_out = compiled(x)
    if not torch.allclose(eager_out, compiled_out):
        print("ALERT: Inconsistent FractionalMaxPool2d detected!")

Indicators of Compromise (IOCs)

• File Hashes: None specific.
• Network Signatures: None.
• Behavioral IOCs:
  • Repeated calls to torch.compile with FractionalMaxPool2d layers.
  • Non-deterministic model outputs in production logs.
  • Error logs containing "FractionalMaxPool2d" and "torch.compile" together.

Detection Engineering

YARA Rule

rule CVE_2025_46150_PyTorch_FractionalMaxPool2d
{
    meta:
        description = "Detects PyTorch code using FractionalMaxPool2d with torch.compile"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2025-46150"
    strings:
        $s1 = "FractionalMaxPool2d" ascii nocase
        $s2 = "torch.compile" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-46150 PyTorch FractionalMaxPool2d Inconsistency
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects usage of FractionalMaxPool2d with torch.compile in Python scripts
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'FractionalMaxPool2d'
            - 'torch.compile'
    condition: selection
falsepositives:
    - Legitimate PyTorch development
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-46150 PyTorch FractionalMaxPool2d Exploit Attempt"; flow:to_server,established; content:"FractionalMaxPool2d"; http_uri; content:"torch.compile"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade PyTorch to version 2.7.0 or later.

   pip install torch>=2.7.0
   

2. Workaround: Avoid using torch.compile with FractionalMaxPool2d until patched.
3. Validation: After patching, re-run model validation to ensure consistency.
4. Monitoring: Implement runtime checks to compare eager and compiled outputs for critical models.

Valters IT
Securing AI Pipelines, One CVE at a Time.