CVE-2023-52304 is a high severity (8.2) stack buffer overflow in paddle.searchsorted in PaddlePaddle before 2.6.0. Invalid shapes can cause a denial of service or worse. The fix ships in 2.6.0, so upgrade PaddlePaddle to 2.6.0 or later and keep untrusted shapes away from it.
What's affected
The NVD record names PaddlePaddle, the open source deep learning framework from the PaddlePaddle project, in every release before 2.6.0. The project's own advisory, PDSA-2023-013, says the fix will be included in PaddlePaddle 2.6.0 and points to the commit 19da5c0c4d8c.
The weakness classes are CWE-120, CWE-787. The record's vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L, which gives 8.2 (High). The advisory itself does not state a score.
The advisory titles the problem as a stack buffer overflow in paddle.searchsorted. A stack buffer overflow means native code writes past the end of a fixed area of memory when given shapes it did not validate. The advisory describes invalid shapes as the trigger. The classes are CWE-120 and CWE-787. The record describes it as able to lead to denial of service or more damage, and rates integrity impact high.
How to check if you're exposed
Paddle ships on PyPI as the paddlepaddle package, and GPU builds use their own package names, so search for anything containing paddle. In the Python environment where you run the framework:
pip list | grep -i paddle
python -c "import paddle; print(paddle.__version__)"
Any version below 2.6.0 is in the affected range. Check every environment, including virtual environments, notebooks, training servers, containers and CI images, since each one carries its own copy.
To find where the library is pulled in, search your requirements files, pyproject files and lockfiles for paddle. Then ask a second question: does any code path hand untrusted input to paddle.searchsorted? The advisory describes the weakness at the level of that one function, so your real exposure depends on whether your application reaches it.
What to do now
- Find every environment that has PaddlePaddle installed, using the commands above.
- Upgrade to 2.6.0 or later, for example with
pip install -U paddlepaddle, then run your tests, since a framework release can change behaviour. - Pin the new version in your requirements file or lockfile so a rebuild does not bring the old one back.
- Until you upgrade, do not pass untrusted values to paddle.searchsorted. Validate shapes, sizes and parameters before they reach the framework.
- Rebuild and redeploy container images that bundle the framework, because old layers keep the old library.
Why it matters
A stack buffer overflow means native code writes past the end of a fixed area of memory when given shapes it did not validate. The advisory describes invalid shapes as the trigger. The classes are CWE-120 and CWE-787. The record describes it as able to lead to denial of service or more damage, and rates integrity impact high.
Memory corruption in a numerical library is hard to judge from the outside. The record leaves room for more than a crash, so treat it as more than a denial of service where untrusted shapes can arrive. This CVE is one of a group of PaddlePaddle issues disclosed together and fixed in the same release, so the single upgrade covers its siblings. It is not in the CISA Known Exploited Vulnerabilities catalog, and the advisory does not report exploitation in the wild. Safeguard's reachability analysis is built for this question, whether a vulnerable function is actually called by your code. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan.
Quick check
Which PaddlePaddle versions does CVE-2023-52304 affect?
The NVD record and the advisory PDSA-2023-013 say versions before 2.6.0. The fix is included in 2.6.0, so that release or later is the target.
Does CVE-2023-52304 affect my application if I never call paddle.searchsorted?
The advisory describes the weakness in that one function, so code that never reaches it is not exposed through this CVE. Confirm by searching your code and your dependencies, and upgrade anyway because the fix is a routine release.
Sources
Last reviewed: 19 October 2026.
