CVE-2023-38675: Medium Divide by Zero in PaddlePaddle matrix_rank

CVE-2023-38675 is a Medium severity flaw (CVSS 4.7) in PaddlePaddle before 2.6.0. The paddle.linalg.matrix_rank function can crash the process with a floating point exception (FPE), causing denial of service. The advisory says the fix ships in PaddlePaddle 2.6.0, so upgrade to that release or later.

What's affected

The record lists PaddlePaddle versions before 2.6.0. The project's own advisory, PDSA-2023-007, says the fix is in commit 9bb6c66 and will be included in PaddlePaddle 2.6.0. That makes 2.6.0 the first fixed release according to the advisory.

The affected code is the paddle.linalg.matrix_rank function. Applications that never call it are not exposed through this CVE, though they may still carry the library.

The advisory and the NVD record word the crash slightly differently. When the input tensor dimensions make the computed rows or cols value zero, the function divides the element count by rows * cols and triggers a floating point exception.

The same advisory series covers sibling issues. Related: CVE-2023-38674 (nanmedian), which shares the same fix commit.

How to check if you're exposed

Find the installed version in each Python environment, virtual environment and container image that uses Paddle:

pip show paddlepaddle
python -c "import paddle; print(paddle.__version__)"

GPU builds are published under a different package name, so check that too:

pip show paddlepaddle-gpu

Then search your repositories for pinned versions in requirements files, lock files and Dockerfiles:

grep -rIn "paddlepaddle" --include=requirements*.txt --include=pyproject.toml --include=Dockerfile .

Any version below 2.6.0 is in the affected range. Next, ask whether your code calls paddle.linalg.matrix_rank and whether the shape of the input can be influenced by a user or an upstream data source. That second question decides how urgent this is.

What to do now

1. Inventory every service, notebook and image that imports Paddle, and record the installed version.
2. Upgrade PaddlePaddle to 2.6.0 or later, then re-run your model tests, since a jump across minor versions can change behavior.
3. If you cannot upgrade yet, validate tensor shapes before they reach paddle.linalg.matrix_rank and reject zero-sized or out-of-range inputs.
4. Run inference services under a supervisor that restarts a crashed worker, and rate limit callers so one request cannot take down a whole pool.
5. Re-scan after the upgrade to confirm no image still carries an older wheel.

Why it matters

The weakness class is CWE-369 (divide by zero). The function trusts the shape of its input and does not handle the degenerate case, so a malformed or empty tensor turns into a native crash. In a Python process that is not a catchable exception. The whole interpreter dies, along with any other work in it.

The impact is limited to availability. The record scores it 4.7 (Medium) with network access, low complexity, user interaction and a changed scope, and no confidentiality or integrity impact. It is not listed in the CISA Known Exploited Vulnerabilities catalog and no advisory reports exploitation. The practical risk is a model-serving endpoint that accepts shapes from callers you do not control. Reachability analysis helps here, because it tells you whether a vulnerable function is ever called from your code, which separates a real exposure from a library that is merely installed.

Quick check

Sources

• PaddlePaddle advisory PDSA-2023-007
• Record data for CVE-2023-38675: NVD description, CVSS vector and CWE

Last reviewed: 19 October 2026.