CVE-2024-31583: Use-After-Free Vulnerability in Torch Package
Summary
CVE-2024-31583: Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp. Affects torch across 2 version ranges.
< 2.2.0
< 9c7071b0e324f9fb68ab881283d6b8d388a4bcd2
Fixed in 9c7071b0e324f9fb68ab881283d6b8d388a4bcd2. How to fix ↓
Also tracked for
The same CVE-2024-31583 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Torch is an open-source machine learning library widely used for applications such as computer vision and natural language processing. It provides a flexible framework for building deep learning models and is known for its ease of use and performance. However, prior to version 2.2.0, Torch was found to have a use-after-free vulnerability that could lead to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2024-31583 is a use-after-free issue located in the interpreter.cpp file of the Torch library. This flaw arises when the program attempts to access memory that has already been freed, which can lead to unpredictable behavior, crashes, or even arbitrary code execution. The vulnerability affects versions of Torch before 2.2.0, making it critical for users to upgrade to the latest version to mitigate risks.
How To Fix
Latest published version: 2.14.1 as of 22 Oct 2026
pip install --upgrade "torch==2.14.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9c7071b0e324f9fb68ab881283d6b8d388a4bcd2
This is the first release that contains the fix.
pip install --upgrade "torch==9c7071b0e324f9fb68ab881283d6b8d388a4bcd2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability other than upgrading to the patched version. Users are advised to avoid using the affected versions until they can perform the update.
Conclusion
The CVE-2024-31583 vulnerability in the Torch package represents a significant security risk for users of versions prior to 2.2.0. It is crucial to upgrade to the latest version to mitigate potential threats. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for torch →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to crashes or exploitation.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Failing to address this vulnerability could expose your application to crashes, data corruption, or even remote code execution by attackers.
You should upgrade to Torch version 2.2.0 or later to ensure that the vulnerability is patched.
Yes, Vulert can monitor various open-source packages for vulnerabilities, providing real-time alerts for your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for torch.
