CVE-2023-38678: Medium Out-of-Bounds Access in PaddlePaddle mode

CVE-2023-38678 is a Medium severity flaw (CVSS 4.7) in PaddlePaddle before 2.6.0. The paddle.mode function can crash the process with a segmentation fault from an out-of-bounds access, causing denial of service. The advisory says the fix ships in PaddlePaddle 2.6.0, so upgrade to that release or later.

What's affected

The record lists PaddlePaddle versions before 2.6.0. The project's own advisory, PDSA-2023-010, says the fix is in commit 19da5c0 and will be included in PaddlePaddle 2.6.0. That makes 2.6.0 the first fixed release according to the advisory.

The affected code is the paddle.mode function. Applications that never call it are not exposed through this CVE, though they may still carry the library.

The advisory and the NVD record word the crash slightly differently. An invalid axis value combined with the tensor dimension size can lead to an access outside the tensor. The NVD record calls it an out-of-bounds access, and the advisory title calls the result a segmentation fault.

The same advisory series covers sibling issues. Related: CVE-2023-38676 and CVE-2023-38677, which share the same fix commit.

How to check if you're exposed

Find the installed version in each Python environment, virtual environment and container image that uses Paddle:

pip show paddlepaddle
python -c "import paddle; print(paddle.__version__)"

GPU builds are published under a different package name, so check that too:

pip show paddlepaddle-gpu

Then search your repositories for pinned versions in requirements files, lock files and Dockerfiles:

grep -rIn "paddlepaddle" --include=requirements*.txt --include=pyproject.toml --include=Dockerfile .

Any version below 2.6.0 is in the affected range. Next, ask whether your code calls paddle.mode and whether the shape of the input can be influenced by a user or an upstream data source. That second question decides how urgent this is.

What to do now

1. Inventory every service, notebook and image that imports Paddle, and record the installed version.
2. Upgrade PaddlePaddle to 2.6.0 or later, then re-run your model tests, since a jump across minor versions can change behavior.
3. If you cannot upgrade yet, validate tensor shapes before they reach paddle.mode and reject zero-sized or out-of-range inputs.
4. Run inference services under a supervisor that restarts a crashed worker, and rate limit callers so one request cannot take down a whole pool.
5. Re-scan after the upgrade to confirm no image still carries an older wheel.

Why it matters

The weakness class is CWE-125 (out-of-bounds read). The function trusts the shape of its input and does not handle the degenerate case, so a malformed or empty tensor turns into a native crash. In a Python process that is not a catchable exception. The whole interpreter dies, along with any other work in it.

The impact is limited to availability. The record scores it 4.7 (Medium) with network access, low complexity, user interaction and a changed scope, and no confidentiality or integrity impact. It is not listed in the CISA Known Exploited Vulnerabilities catalog and no advisory reports exploitation. The practical risk is a model-serving endpoint that accepts shapes from callers you do not control. Reachability analysis helps here, because it tells you whether a vulnerable function is ever called from your code, which separates a real exposure from a library that is merely installed.

Quick check

Sources

• PaddlePaddle advisory PDSA-2023-010
• Record data for CVE-2023-38678: NVD description, CVSS vector and CWE

Last reviewed: 19 October 2026.